As the risk and severity of data breaches continue to rise, companies are becoming increasingly concerned with protecting sensitive data and proprietary information. This has led to the rising importance of threat modeling, where security professionals need to learn to build and maintain a comprehensive threat library for real-time decision-making analytics.
The Breach Level Index estimates that nearly 5 million records are lost or stolen every day¹. The possibility of an organization experiencing a breach over the next 24 months is almost one in three, and the average total cost of a data breach is $3.86 million, according to the 2018 Ponemon Report².
Traditionally, businesses have attempted to secure applications and systems after deployment – however, this approach favors the attacker who needs to find only a single weak point in the system. Security professionals, on the other hand, must protect the entire system against an array of threats from a variety of malicious actors.
With a threat modeling process, however, organizations can shift security strategy: from a reactive process taking place after deployment, to a proactive process, systematically addressing threats from design through production.
Getting Started with Threat Modeling
Threat modeling is a method for CISOs and infosec teams to identify internal and external threats to networks, software programs, and applications, and decide on countermeasures to mitigate the effects of those threats. It presents many benefits to an organization: not only can companies realize substantial cost savings, but it also allows classification and prioritization of the most critical threats while providing actionable output to CISOs and other stakeholders across the organization.
Perhaps most importantly, a threat modeling process provides a threat intelligence framework for addressing potential system threats – a repeatable process that security teams can scale as required by the organization. It involves setting a practical, actionable plan for securing networks, applications, and systems in a constantly changing environment.
How to Build a Comprehensive Threat Library
The first step in any threat modeling initiative is to build a comprehensive threat library. It is essential to know which threats apply to a system, and the potential impact of each threat, for an organization to reach an appropriate level of security at a reasonable cost.
Public threat libraries are available from various sources; however, each system is made up of unique applications, specific requirements, and targeted threats that apply differently to different organizations. Because of this exceptionality, each organization must create a unique, comprehensive threat library of their own.
- First, construct a threat model template that can be used to consistently define the properties of a threat. The template should delineate details of how a threat could be executed, and profile hypothetical attackers while noting their possible skill level and motivation.
- Within the template, include a risk assessment of the threat taking place, the potential impact of the threat, and the security controls that can be implemented to mitigate the threat.
- Once you complete the template for potential threats, classification can occur based on risk and impact assessments. An organization can then prioritize efforts, addressing the most high-risk areas for the best use of limited resources and the best return on investment.
After building a threat library, your organization can focus on creating scalable, actionable initiatives that, depending on various threat modeling methodologies, can apply to all applications throughout an organization. An organized, indexed, centralized repository of information keeps key stakeholders informed and updated on potential threats and the status of security efforts throughout the organization.
ThreatModeler is the industry’s leading security and risk management solution for each part of the IT ecosystem. By helping businesses scale their threat-identification and defense systems, they can protect themselves from harmful and costly data breaches throughout the entire agile development process. ThreatModeler’s team of data- and cyber-security experts partner with CISOs, DevOps execs, and developers of applications to identify and test vulnerable entry points and optimize their company-wide security infrastructure.
To see how ThreatModeler can drive security throughout your enterprise with the industry’s leading automated threat modeling platform, sign up for a 10-day free evaluation.
Sources:
¹ https://www.csoonline.com/article/3251606/data-breach/what-does-stolen-data-cost-per-second.html
² https://www.ibm.com/security/data-breach