4 ms·

What do you use for threat modeling? Is there some sort of common formal process, even tools? Or is it still pen and paper / spreadsheets?

by mahmud 16y ago

tptacek 16y ago
We have an internal, formal process. I think it works well if you have an established SDL; if you can point to your team and say "we're in the design phase, and this is the deliverable from that phase, and this is how it will govern development", then threat models are a valuable addition to that process. But unlike training, code review, and testing, threat models are actually closer to a project management tool than they are to a technical safeguard. I wouldn't invest in it until you feel like you've got a groove going with code review and testing.
- mahmud 16y ago
  I always thought something like that ought to be better integrated with development. Threat modeling should, ultimately, dictate not only input validation, but also application deployment and architecture. However, I am not sure how best to do this without falling into the rabbit-hole of type systems, and semantic consistency of programming languages. Not to mention the arduous task of compiling "semantic signatures" of system libraries, OS facilities, known 3rd party application limitations/bugs, protocols, in addition to "business rules" that dictate how the application is used. Maybe one day, when systems software is generated by an Eclipse plugin, and the stubs, with unit tests and design-by-contract guards sent off to minion coders to fill in the blanks. In the mean time, anybody attempting to formalize this seriously risks becoming a theory-weenie, working in a "perfect formal system." For now, ad-hoc reigns.
jdp23 16y ago
There are some threat modeling tools out there -- Microsoft has one (although I haven't used it) at http://www.microsoft.com/security/sdl/getstarted/threatmodeling.aspx http://www.microsoft.com/security/sdl/getstarted/threatmodel... (there are also soime good links on the right). or it can be less formal, like the EOP game http://www.microsoft.com/security/sdl/eop.aspx http://www.microsoft.com/security/sdl/eop.aspx pencil and paper works well for doing an initial threat model, although not for sharing it and evolving it over time. threat modeling does have some project management and QA aspects (it's a good basis for generating a security testing plan) ... it's also very educational in helping developers learn to think about things from a security perspective.

What do you use for threat modeling? Is there some sort of common formal process, even tools? Or is it still pen and paper / spreadsheets?

by mahmud 16y ago

What do you use for threat modeling? Is there some sort of common formal process, even tools? Or is it still pen and paper / spreadsheets?

tptacek 16y ago

We have an internal, formal process. I think it works well if you have an established SDL; if you can point to your team and say "we're in the design phase, and this is the deliverable from that phase, and this is how it will govern development", then threat models are a valuable addition to that process. But unlike training, code review, and testing, threat models are actually closer to a project management tool than they are to a technical safeguard. I wouldn't invest in it until you feel like you've got a groove going with code review and testing.

mahmud 16y ago
I always thought something like that ought to be better integrated with development. Threat modeling should, ultimately, dictate not only input validation, but also application deployment and architecture. However, I am not sure how best to do this without falling into the rabbit-hole of type systems, and semantic consistency of programming languages. Not to mention the arduous task of compiling "semantic signatures" of system libraries, OS facilities, known 3rd party application limitations/bugs, protocols, in addition to "business rules" that dictate how the application is used. Maybe one day, when systems software is generated by an Eclipse plugin, and the stubs, with unit tests and design-by-contract guards sent off to minion coders to fill in the blanks. In the mean time, anybody attempting to formalize this seriously risks becoming a theory-weenie, working in a "perfect formal system." For now, ad-hoc reigns.

jdp23 16y ago

There are some threat modeling tools out there -- Microsoft has one (although I haven't used it) at http://www.microsoft.com/security/sdl/getstarted/threatmodeling.aspx http://www.microsoft.com/security/sdl/getstarted/threatmodel... (there are also soime good links on the right). or it can be less formal, like the EOP game http://www.microsoft.com/security/sdl/eop.aspx http://www.microsoft.com/security/sdl/eop.aspx pencil and paper works well for doing an initial threat model, although not for sharing it and evolving it over time. threat modeling does have some project management and QA aspects (it's a good basis for generating a security testing plan) ... it's also very educational in helping developers learn to think about things from a security perspective.