Open Access Open Access  Restricted Access Subscription or Fee Access

Threat Modeling- A Survey

Pooja Lahoti, Pragya Shukla

Abstract


Generally, Security assessment is performed on applications after they are developed to identify issues and then required measures are taken to fix those issues. This can help but it is costlier approach to address the issues later. The steps run in multiple iterations and can be avoided if we take this issue earlier by finding the issues in the life cycle of the application development only. Here comes the role of Threat Modeling, which makes it possible to identify all potential threats to the software system in designing phase. Microsoft included Threat Modeling as a one of the practice in the Security Development Life-cycle to ensure that security built-in like identifying vulnerabilities, determining risks from the threats, and establishing appropriate mitigating methods can easily be identified more effectively and less expensively from the very beginning. The numerous works have been published on threat modeling. We examine the differences between modeling software tools and which is best suited for what and will discuss on the issues reported by Microsoft.


Keywords


SDLC, Security, Threat Modeling, Web Applications.

Full Text:

PDF

References


Adam Shostack, Microsoft. Experiences Threat Modeling at Microsoft.

Marwan Abi-Antoun, Carnegie Mellon University. Daniel Wang, Microsoft Corporation. Peter Torr, Microsoft Corporation. Checking Threat Modeling Data Flow Diagrams for Implementation Conformance and Security.

Drake Patrick Mirembe, Faculty of Computing and IT Makerere University Kampala. Maybin Muyeba, Intelligent and Distributed Systems Liverpool Hope University, Threat Modeling Revisited: Improving Expressiveness of Attack.

Suvda Myagmar, Adam J.Lee, William Yurcik. National Centre for Supercomputing Application (NCSA) University of Illinois at Urbana- Champaign, Threat Modeling as a Basis for Security Requirements.

Steven F Burns, GIAC Security Essentials Certification (GSEC) Practical Assignment v1.4c January 5, 2005. Threat Modeling: A Process to Ensure Application Security.

Michal Howard and David LeBlanc, ebook- Writing Secure Code 2nd Edition Microsoft Press.

Shafiq Hussain1, Asif Kamal2, Shabir Ahmad3, Ghulam Rasool4, Sajid Iqbal5, Department of Computer Science, BahauddinZakariya University, Sub-Campus Sahiwal, Pakistan. Threat Modeling Methodologies: A Survey.

Guifre Ruiz, Elisa Heymann, Eduardo Cesar and Barton P. Miller, Automating Threat Modeling through the Software Development Life-Cycle.

SANS Institute, InfoSec Reading Room. Threat Modeling: A Process To Ensure Application Security.

Michal Howard and Steve Lipner Foreword by Jim Allichin Co-president, Platforms & Services Division, Microsoft Corporation. Best Practice: The Security Development Lifecycle at Microsoft.

Michael Howard, Senior Principal Cybersecurity Architect, Mark Simos, Cybersecurity Architect, Sean Finnegan, Cybersecurity Director , Vic Miles, Retail Technology Strategy. A Systematic Method to Understand Security Risks in a Retail Environment at Microsoft v1.03

Nick Peterman Vrije University IT Amsterdam, Threat modeling of Enterprise Content Management Systems

Comparing ThreatModeler to Microsoft Threat Modeling Tool (TMT) blog by MyAppSecurity June’3, 2014.

Available: http://myappsecurity.com/comparing-threatmodeler-microsoft-tmt-threat-modeling-tool/

SDL Threat Modeling Tool by Microsoft.

Available: http://www.microsoft.com/security/sdl/adopt/threatmodeling.aspx

Introducing Microsoft Threat Modeling Tool 2014. Microsoft Team Trustworthy Computing, Microsoft April’15, 2014.

Available: http://blogs.microsoft.com/cybertrust/2014/04/15/introducing-microsoft-threat-modeling-tool-2014/

Application Threat Modeling, OWASP.

Available: https://www.owasp.org/index.php/Application_Threat_Modeling.


Refbacks

  • There are currently no refbacks.


Creative Commons License
This work is licensed under a Creative Commons Attribution 3.0 License.