When threat modeling methodologies first moved from theory to application in the early 2000s, completing one model for every 40 hours of personnel resource was considered acceptable. Increasingly, internal compliance, external regulatory pressures and financial consequences are pushing threat modeling as a required cybersecurity activity. Organizations are discovering the practical limitations of their traditional threat modeling process.
DevOps teams nowadays are pressured to build security in as early as possible. Shift security left and ensure every end is practicing security. Security is everyone’s responsibility, not a specific team. With all this said, there is an increasing need to develop a scalable threat modeling practice that can handle, not just fifty to sixty models per year, but hundreds or thousands of models. Threat modeling software users should also be able to make changes quickly as applications are updated or whenever a new threat is cataloged.
What Scalable Threat Modeling Means to the Organization
As organizations build their threat modeling practice, security departments are increasingly overwhelmed by the workload. Increasing the information security budget may relieve the pressure – for a short while. The reality, though, is without a scalable threat modeling process, security personnel and budgets will be stretched beyond their capacity.
Simply put, a scalable threat modeling practice provides security personnel with effectiveness, efficiency, and momentum in all their efforts. This results in an effective, organization-wide implementation of security measures. But if each threat model consumes 40 subject matter expertise hours, this output will amount to little more than an unrealized pipe dream, especially in an agile development methodology now par with the course for many organizations.
An enterprise-wide scalable threat modeling process enables the security department to sync their efforts with the strategic business objectives discussed in the C-Suite. This, then, drives the implementation of security objectives throughout the organization. Security personnel will be able to stop chasing after urgent emergencies, e.g. a data breach, and be proactive in systematically implementing organizational long-term initiatives. Obtaining to that level of maturity involves three key pillars of a scalable threat modeling practice.
Three Pillars of a Scalable Threat Modeling Practice
-
Automation
If creating a single application threat model consumes 40 resource hours, then one resource can – at most – theoretically create 50 threat models per year. However, the reality is that each threat model will need to be updated multiple times as the applications undergo numerous enhancements and improvements. Additionally, each threat model will need to be updated every time the company’s catalog of threats is updated. While a single resource could theoretically complete up to 50 models per year, a more realistic estimate might be 20-30 unique models.
However, consider the effect your security team could achieve if each personnel resource, rather could instead complete 150-250 unique threat models. Moreover, what if each of those unique threat models could be updated to match application revisions in just minutes rather than in days? Keep in mind the efficiency your team would gain if every time the threat catalog was updated, if each threat model could be updated with the click of a button?
The ability to create 150-250 unique models per year, per resource, and to enable the development team to be an integral part of the automated threat modeling process can be achieved through the adaptation of a process flow diagram (PFD) based approach.
-
Integration
Most organizations have a mature SDLC or CDLC process with various tools that automate the development process at different stages. Tools like CMDB, Developer IDE, Bug Tracking, plus established vulnerability and penetration testing procedures are already in use throughout the SDLC process. For scalable threat modeling to be practically realized, it has to integrate with these tools to provide seamless output to the development and security teams.
A scalable threat modeling practice will drive the security process by identifying all the potential threats ahead of time, ideally during the design phase. The effectiveness of the practice will be validated by the scanning tools, ensuring that all the prioritized threats have been properly mitigated. Through integrating with the existing SDLC process and tools, the bottleneck at vulnerability scanning and remediation will be reduced.
True integration, though, is gained across the entire SDLC or CDLC initiative only if the threat modeling practice is itself agile. Then it may seamlessly fit into the development team’s workflow and actually augment their sprint –- to vulnerability testing and production. And if your automated application threat model is PFD-based, integration with the development team is relatively easy to achieve.
-
Collaboration
In an organization, there are four key groups of stakeholders throughout the secure SDLC process who are responsible for building and using threat models:
- Architects provide functional information about the application and high-level risk analysis
- Developers are responsible for implementing secure coding standards
- Security team identifies relevant threats and their appropriate mitigations, provide verification of mitigations, and manage identified vulnerabilities
- Senior executives assess the organizational threat profile relative to the ERM and prioritize the risk management measures
When these stakeholders are enabled to collaborate synergistically, the entire threat modeling practice can scale organically to any number of required threat models the organization may require. In such an environment, developers and architects themselves build and update the application threat models of the projects for which they are responsible. Security teams then can review and provide guidance to development teams as and when required.
Development and security build on each other’s work, thereby reducing the time and effort required to build and maintain threat models significantly. By collaboratively involving multiple stakeholders in the threat modeling process, organizations are able to scale to the level of 1,000s of threat models annually.
With ThreatModeler, Automated, Scalable Threat Modeling is Within Reach
A scalable threat modeling solution is critical for organizations seeking a secure SDLC practice within the constraints of available resources. With scalability, the security personnel gains significant efficiency and momentum as they are increasingly freed to focus on holistic security, enhancements and improvements. Scalable threat modeling built upon the three pillars of automation, integration, and collaboration also creates significant payoffs for the architectural and development team as well as the senior executives. Scalability is a win-win across the entire organization.
ThreatModeler has driven automated, cloud-based threat modeling that takes the guesswork out of a typically manual, time-consuming activity. ThreatModeler maintains a reliable threat content framework that helps organizations to achieve a security level that is up-to-speed with best practices, while achieving compliance with internal and external regulatory requirements.
If you would like to see scalable threat modeling in action, schedule a live ThreatModeler demo.