Attack surface management: The move to cloud poses unique challenges as organizations adapt to securing infrastructure as code for all applications, while being prepared to secure brave new features such as containers, microservices and automatic scaling. Threat modeling, traditionally a manual process, would take weeks to enumerate potential threats with diagramming tools or whiteboarding to gain an understanding of your attack surface.

Cloud Threat Modeling: What Is Cloud Threat Modeling? Cloud threat modeling focuses on identifying and addressing threats in cloud environments, which require specialized security considerations due to their complexity and dynamism. With the widespread adoption of cloud and hybrid and multi-cloud strategies, cloud threat modeling is crucial for attaining and maintaining a robust security posture for today’s businesses….

Cyber Risk Management: What Is Cyber Risk Management? The term “cyber risk” broadly describes any threat, vulnerability, or exposure (such as regulatory compliance) that could damage or disrupt an organization’s IT systems, business operations, or reputation. Effective cyber risk management proactively identifies and assesses threats to reduce the likelihood and potential severity of attacks.  Because threats come in…

OCTAVE Threat Methodology: What Is OCTAVE? OCTAVE is a framework for detecting, categorizing, and prioritizing threats and vulnerabilities in applications and IT systems, primarily for small to midsize businesses. Short for Operationally Critical Threat, Asset, and Vulnerability Evaluation, the OCTAVE methodology employs a business-oriented approach that focuses on quantitative risk weighting and organizational risks to protect assets.  What…

Security Countermeasures: What Are Security Countermeasures? Security countermeasures include any technology, policy, or practice that help mitigate risk by reducing the vulnerability of IT systems, protecting against cyber threats, or helping meet security requirements. Security countermeasures can be technical, administrative, or physical controls, and can be categorized as:  Security countermeasures can be layered in what is known…

Threat Analysis: What Is an Attack Surface? An attack surface refers to all the points, interfaces, and avenues through which a bad actor can try to enter or extract information from a system, network, or application. These include: What Is Threat Analysis? Threat analysis involves identifying potential threats, understanding their severity and potential impact, and developing mitigation…

Threat Boundary: What Is a Threat Boundary? Also known as a trust boundary, a threat boundary is a dividing line or partition between areas of systems (whether internal or external) which may separate networks, applications, or organizations, as well as different security classifications of data. Threat boundaries define where security controls should be implemented between trust zones…

Threat Intelligence Framework: What Is a Threat Intelligence Framework? A threat intelligence framework is a structured system that gathers, analyzes, and applies threat data to improve organizational defenses. It helps teams make informed decisions based on real-time data, enabling better preparedness against cyber risks [link to TM glossary article]. Threat intelligence frameworks generally entail several discrete phases: setting…

Threat Library: What Is a Threat Library? A threat library is a central repository for threat intelligence, including information about known threats, vulnerabilities, and attack methods, as well as predefined security patterns and templates for creating threat models. A well-built threat library serves as a knowledge base for security teams, providing the essential data and context to…

Threat Modeling Methodologies and Methods: What Is a Threat Modeling Methodology? A threat modeling methodology is a structured approach used to identify, analyze, and mitigate security threats in applications and systems. Many methodologies—such as STRIDE, PASTA, OCTAVE, and VAST—have been developed in recent decades, each blending their own unique processes with generally accepted principles. Typically, a given methodology focuses on…