Asset-Oriented Threat Modeling

Abstract

Threat modeling is recognized as one of the most important activities in software security. It helps to address security issues in software development. Several threat modeling processes are widely used in the industry such as the one of Microsoft SDL. In threat modeling, it is essential to first identify assets before enumerating threats, in order to diagnose the threat targets and spot the protection mechanisms. Asset identification and threat enumeration are collaborative activities involving many actors such as security experts and software architects. These activities are traditionally carried out in brainstorming sessions. Due to the lack of guidance, the lack of a sufficiently formalized process, the high dependence on actors' knowledge, and the variety of actors' background, these actors often have difficulties collaborating with each other. Brainstorming sessions are thus often conducted sub-optimally and require significant effort. To address this problem, we aim at structuring the asset identification phase by proposing a systematic asset identification process, which is based on a reference model. This process structures and identifies relevant assets, facilitating the threat enumeration during brainstorming. We illustrate the proposed process with a case study and show the usefulness of our process in supporting threat enumeration and improving existing threat modeling processes such as the Microsoft SDL one.Index Terms-threat modeling (process), asset-based reference model, asset identification, attack pattern

RQCODE – Towards Object-Oriented Requirements in the Software Security Domain

“…The security aspect is suggested to be considered as early as possible in SDLC to prevent potential damages caused by undiscovered vulnerabilities [6]. That is why our focus in this paper is on security requirements.…”

A Survey on Threat-Modeling Techniques: Protected Objects and Classification of Threats

“…Nan Messe, Vanea Chiprianov, Nicolas Belloir, Jamal El-Hachem, Regis Fleurquin and Salah Sadou, in [10], strove to structure the asset identification stage by offering a systematic asset identification process based on a reference model. The authors illustrated the proposed process by example, and demonstrated the usefulness of their process for supporting threat enumeration and improving existing threat-modeling processes, such as Microsoft SDL.…”

ThreMA: Ontology-Based Automated Threat Modeling for ICT Infrastructures

“…ThreMA has been designed for modelling complete ICT infrastructures through a formal dictionary shared by all the experts involved in the threat modelling process. In addition, according to [42], a well-defined rule set has been defined for supporting system modelling, in order to prevent misconceptions that could lead to sub-optimal or erroneous threat identification. As it will be seen in the following sections, there is a tight link between how the threat catalog is organised and how the infrastructure components are described.…”

“…Particular attention has been placed on representation and organisation of assets. As defined in [42], an asset can be either something valuable for the organisation or everything that may contain vulnerabilities that can be menaced by threats. Hence, not only the stored data, the networks and the digital services must be modelled but, more in general, every device and software connected to the ICT infrastructure that could be the target and/or the vector of possible attacks.…”