One major mistake that businesses often make is dedicating testing and rigour to systems, apps, and business processes while they’re already in development or, in many cases, already in use.

Cyber threats, software vulnerabilities across third-party APIs and general business inefficiences are ever-present and persistent: an example that was breaking in the news while this year’s Scot-Secure was taking place at Dynamic Earth in Edinburgh, was popular video conferencing software, 3CX, who – through a vulnerability in its installers – was undergoing a supply chain attack, forcing the company into developing an emergency software update.

Companies understand they need to step up their security measures to prevent threats from attacking, and robustly respond to attackers quickly and effectively. But how can they best do this against an ever-evolving and pernicious threat landscape?

While having a continuous evaluation process to improve security posture is obviously always going to be beneficial, Jen Williams, Director of IT and Operations at Secarma extolled – to a packed Scot-Secure 2023 – the virtues of threat modelling, something that a myriad of businesses, from those developing software and utilising third-party APIs, to those with complex business procedures that handle sensitive data, can all get benefit from.

What is Threat Modelling?

Essentially a risk management activity, while threat modelling is not always a technical exercise, it does provide a structure for examining business processes while monitoring potential threats to the business.

Williams says, when performed by someone on your team with a deep technical understanding of an application, module or business practice, it “allows you to implement mitigation actions to lessen the possibility of a cyber-attack or data compromise.”

As opposed to something like penetration testing, threat modelling is a more hands-off tabletop exercise, usually done “at design stage, letting you iron out those vulnerabilities before you’ve written any code,” says Williams.

The benefits of this over penetration testing being that the latter can be very invasive, “for example, you might only be able to do it at certain times of the day so as not to affect service,” Williams adds.

According the OWASP foundation, a threat model typically includes:

• Description of the subject to be modelled
• Assumptions that can be checked or challenged in the future as the threat landscape changes
• Potential threats to the system
• Actions that can be taken to mitigate each threat
• A way of validating the model and threats, and verification of success of actions taken

Furthermore, threat modelling can be conducted using internal resources, with the practice most effective when conducted by those with an intimate understanding of what you’re designing or refining.

On this, Williams says: “You need people who know any third-party APIs you use in detail, it isn’t something that can be done by one person – it has to be a team.”

When and why should you Threat Model?

Detecting problems early on in software development makes it much more efficient and cheaper to resolve as opposed to doing it later on, when it might be too late – and it will certainly be more complex and expensive.

“You want to find these things as early as possible,” says Williams.

She adds: “Incorporating threat modelling at the design stage of a new build can dramatically reduce costs. Other great times to do it are prior to significant system change or upgrade, or in response to a significant world event.

“Who knew four years ago that we were going to have a global pandemic and it would be used against businesses? Or a huge war that has changed the face of threat actors?”

Beyond these more severe aspects of things that can go wrong, Williams states that on a smaller scale, the process of threat modelling can allow you to spot inefficiencies, flaws, and capacity issues that you didn’t even think of before.

“It allows businesses to really consider a risk-based approach,” says Williams.

She adds: “It helps you understand who your potential threat actors are and how they could potentially access your systems, giving you a much better understanding of your attack surface.”

Recommended

• Maintaining Trust in AI-Based Journalism
• Scot-Secure | Just One Day to Go!
• More than Just Code: Soft Skills Prove Vital to Developers

The major outcome you’ll get from successful threat modelling is a data flow diagram that shows entry points into the system – “the way you can interact with the log-in page, the infrastructure etc,” says William’s.

She adds: “From here, you’ll end with a list of prioritised threats.”

From here, it’s much easier for you to build out a solid contingency plan.

Using the heist from Ocean’s Eleven to analogously illustrate the various steps in how a threat actor would execute an attack – Williams says threat modelling is akin to looking at each of these steps and figuring out a way to thwart at that stage before committing anything to code, when it then becomes much more complex and expensive to address.