-
Book Overview & Buying
-
Table Of Contents
Threat Modeling Best Practices
By :
Creating a threat model means that you need to know what it is that you’re modeling. This includes what’s in your purview, what you have control over, and what your environment looks like. More importantly, you need to consider what security controls already exist in your environment that mitigate possible threats that tie into the overall scope of the model and the assumptions you make.
In threat modeling, assumptions are the beliefs or expectations about the system, environment, users, or adversaries that shape how threats are identified, prioritized, and mitigated. When we do threat modeling, we assume that certain things are in place: a firewall, Multi-Factor Authentication (MFA), and security-versed users of the system. The reality is that those should never be taken for granted as being there and properly configured.
Nonetheless, the process of threat modeling requires defining the scope and clarifying the assumptions...
Change the font size
Change margin width
Change background colour