What are the best resources to learn about threat modeling for risk management?

1 Why threat modeling matters

Threat modeling helps you to understand your attack surface, the sources and motivations of your adversaries, and the impact and likelihood of different attack scenarios. By applying threat modeling throughout the development lifecycle, you can ensure that your security requirements are aligned with your business objectives and that your solutions are resilient to evolving threats. Threat modeling also helps you to communicate and justify your security decisions to stakeholders, regulators, and auditors.

2 How to perform threat modeling

Threat modeling involves different methodologies and frameworks, but generally follows a similar process. Begin by defining the scope and context of your system, asset, or data. Identify the boundaries, components, data flows, trust boundaries, and assumptions of your system. You can use diagrams, models, or templates to document and visualize your system. Then, identify the threats to your system, asset, or data. Sources such as threat intelligence, industry standards, best practices, or historical data can be used to identify the relevant threat actors, their capabilities, goals, and tactics. Techniques such as STRIDE, PASTA, or OCTAVE can also be employed to categorize and enumerate the threats. Next is analyzing the risks of the threats. Assess the impact and likelihood of each threat in relation to existing or planned security controls, mitigations, and compensating factors. Matrices, ratings, or scores can be used to quantify and prioritize the risks. Lastly is defining countermeasures for the threats based on the risk analysis. Appropriate actions should be determined to address the threats such as implementing security controls or policies; accepting or transferring risk; or monitoring or testing the system. Remember to document and review your threat model which includes system description; threat identification; risk analysis; and countermeasures. You should review and update your threat model regularly when changes occur in your system or environment.

3 What are the best resources to learn about threat modeling

Learning about threat modeling can be made easier with the help of various resources, such as the Microsoft Threat Modeling Tool, the OWASP Threat Dragon, the Threat Modeling Manifesto, the Threat Modeling Book by Adam Shostack, and the Threat Modeling Podcast by Izar Tarandach. The Microsoft Tool provides a graphical interface, templates, guidance, and reports to assist in creating and analyzing threat models using the STRIDE methodology. The OWASP Threat Dragon supports both STRIDE and DREAD methodologies and allows for storage and sharing of threat models online or offline. The Threat Modeling Manifesto defines principles, values, and benefits of threat modeling. The Threat Modeling Book is a comprehensive guide to the theory and practice of threat modeling with examples, case studies, and best practices. Finally, the podcast provides interviews with various threat modeling experts and enthusiasts.

4 How to improve your threat modeling skills

If you want to sharpen your threat modeling skills, practice and learn from others. Joining a threat modeling community is a great way to network, share, and learn from other threat modeling professionals and enthusiasts. Examples include the OWASP Threat Modeling Project, the Threat Modeling Slack Channel, and the Threat Modeling Mailing List. Additionally, taking a course or workshop is beneficial as they can teach you the fundamentals and advanced techniques of threat modeling. Examples are the Threat Modeling Training by Adam Shostack, the Threat Modeling Bootcamp by Avi Douglen, and the Threat Modeling Masterclass by Toreon. Lastly, reading blogs and articles can keep you up-to-date on the latest trends, innovations, and challenges in threat modeling. Examples include the Threat Modeling Blog by Adam Shostack, the Threat Modeling Category by Security Boulevard, and the Threat Modeling Section by Infosec Institute.

5 Here’s what else to consider

This is a space to share examples, stories, or insights that don’t fit into any of the previous sections. What else would you like to add?