3 ms·

Am I the only one having a very, very hard time parsing much on threat modeling out of this article? Wikipedia seems to confirm my understanding as to what thr

by donw 6y ago

Am I the only one having a very, very hard time parsing much on threat modeling out of this article? Wikipedia seems to confirm my understanding as to what threat modeling is: "Threat modeling is a process by which potential threats, such as structural vulnerabilities or the absence of appropriate safeguards, can be identified, enumerated, and mitigations can be prioritized." There's a little bit in the article about mapping your system, and maybe at looking at interfaces and interaction points? Don't see anything about attack vectors, modes of detection and response, etc. Also, why only the look at digital security? Being aware of how your systems interact with the physical environment can have a strong influence in how you approach architecture, even if the answer boils down to "our infrastructure team handles that".

austincheney 6y ago
Threat modeling is all I get from the article. It is a vague conceptual guide. If you were hoping for code, software tools, or commands to type from your keyboard I understand your disappointment. Security is often difficult to explain to software developers, because (contrary to what many developers believe) security is so far outside the training and experience of writing software. It’s like trying to explain relational data theory to school children with crayons. It’s not that the children are stupid, they are probably smarter than you and I, but that data theory is not a part of their world view and in practice they really really don’t care. Yet, many developers falsely believe they have a solid understanding of security despite a lack of experience, training, certification, or interest in the subject. This, more than anything else, explains why opinions and articles from security researchers are frustrating to software developers and why security researchers prefer to not engage software development communities aside from some highly focused security oriented groups. After working in security for a few years the subject really boils down to two boring words: risk analysis in the most abstract way possible. As a developer we like to think of security in terms of 0day exploits, patches, audits, memory safety, and so forth but those are just symptoms/remediations of. It like comparing pills and needles to medicine.
- Mandatum 6y ago
  From my experience, risk analysis or threat modelling for most software is done in approximately.. 1 of the customers I've dealt with. And they had a big bankroll, with bigger compliance/regulations/security reqs than most (incl typical F&I and HealthCare orgs). n = 1 and I don't live in NA or EU, but security isn't even an afterthought.
- donw 6y ago
  > If you were hoping for code, software tools, or commands to type from your keyboard I understand your disappointment. I have a background in physical and network security from my days at a legal services firm, so nope. :) There really aren't software tools or commands for the modeling part, for the same reason there aren't commands for "design me an architecture". > It is a vague conceptual guide. Too vague to be useful, is I think my critique. As an aside, way too many firms have a massive blind spot on the physical security side of things -- it's crazy how bad it is.
  - ghostpepper 6y ago
    What percentage of digital threats could evade your digital protections by having physical access to the hardware? Almost all of them. What percentage are likely to ever do it? It seems like it would be much smaller, but maybe I'm missing something?
LeonigMig 6y ago
The sections on attack vectors, modes of detection and response, etc were published today It was published in instalments, which is a bit confusing There's a bit about interfacing with infrastructure teams in one of the later instalments also

by donw 6y ago

austincheney 6y ago

Threat modeling is all I get from the article. It is a vague conceptual guide. If you were hoping for code, software tools, or commands to type from your keyboard I understand your disappointment. Security is often difficult to explain to software developers, because (contrary to what many developers believe) security is so far outside the training and experience of writing software. It’s like trying to explain relational data theory to school children with crayons. It’s not that the children are stupid, they are probably smarter than you and I, but that data theory is not a part of their world view and in practice they really really don’t care. Yet, many developers falsely believe they have a solid understanding of security despite a lack of experience, training, certification, or interest in the subject. This, more than anything else, explains why opinions and articles from security researchers are frustrating to software developers and why security researchers prefer to not engage software development communities aside from some highly focused security oriented groups. After working in security for a few years the subject really boils down to two boring words: risk analysis in the most abstract way possible. As a developer we like to think of security in terms of 0day exploits, patches, audits, memory safety, and so forth but those are just symptoms/remediations of. It like comparing pills and needles to medicine.

Mandatum 6y ago
From my experience, risk analysis or threat modelling for most software is done in approximately.. 1 of the customers I've dealt with. And they had a big bankroll, with bigger compliance/regulations/security reqs than most (incl typical F&I and HealthCare orgs). n = 1 and I don't live in NA or EU, but security isn't even an afterthought.
donw 6y ago
> If you were hoping for code, software tools, or commands to type from your keyboard I understand your disappointment. I have a background in physical and network security from my days at a legal services firm, so nope. :) There really aren't software tools or commands for the modeling part, for the same reason there aren't commands for "design me an architecture". > It is a vague conceptual guide. Too vague to be useful, is I think my critique. As an aside, way too many firms have a massive blind spot on the physical security side of things -- it's crazy how bad it is.
- ghostpepper 6y ago
  What percentage of digital threats could evade your digital protections by having physical access to the hardware? Almost all of them. What percentage are likely to ever do it? It seems like it would be much smaller, but maybe I'm missing something?

LeonigMig 6y ago

The sections on attack vectors, modes of detection and response, etc were published today It was published in instalments, which is a bit confusing There's a bit about interfacing with infrastructure teams in one of the later instalments also