Threat modeling is a vital part of the product development process, and it truly never ends. Camille takes a deep dive on today’s episode of What That Means; she is joined by Jonathan "Jonny" Valamehr, Principal Engineer at Intel, and Dina Treves, Senior Very Large Scale Integration (VLSI) Engineer at Intel, to find out things like which thought processes go into threat modeling, why there is no standardized threat model, as well as how the ever-evolving vulnerability landscape affects threat modeling.
They cover:
The meaning of threat modeling and why it needs to be done early and repeatedly
How to know what threats are out there, as well as how to prioritize them
The sorts of things that are helpful to design teams when threat modeling
Why it’s just as important to think like an attacker as it is to think like a victim when threat modeling
How combining things like biometrics with traditional password protection can really boost cybersecurity
... and more. Great conversation, don’t miss it!
The views and opinions expressed are those of the guests and author and do not necessarily reflect the official policy or position of Intel Corporation.
Here are some key take-aways:
To understand threat modeling, you need to take three terms into account - assets (things like information you want to protect), adversaries (usually ill-intentioned parties with the skills to steal or damage assets, but adversaries can also occur accidentally through leaks, etc.), and attack surfaces (which adversaries use to get into systems and access assets).
Threat modeling looks at all three of those elements and tries to map out all of the “what if’s” to prevent or lessen the damage of future attacks.
Threat landscapes evolve along with technology, so threat modeling often differs depending on use case and product.
Threats are categorized as “in scope” or “out of scope”; the former refers to things we want to protect against that may likely happen in real life, whereas the latter refers to things that are less likely to occur and therefore receive less focus.
Every threat model is unique because each situation is unique; rather than opting for a blanket solution, which would create a lot of unnecessary work and potentially distract from protecting against the most relevant attacks, it’s important to consider each case on its own.
Design teams are greatly aided by research teams (both internal and external, such as academics) who do the leg work in identifying vulnerabilities, thus allowing teams to learn and update their systems quickly.
Malicious actors can also sometimes help reveal vulnerabilities by exploiting them in the real world.
You really need to be able to understand use cases to discover abuse cases.
And it’s important to note that while a lot of threat modeling focuses on the early stages of a product, the process continues throughout the whole life cycle of a product.
Some interesting quotes from today’s episode:
“When we have a product, we design a product, we think with a functional mindset; we want to make sure that our product does what it’s supposed to do. But when we think with a security mindset, we want to make sure that it doesn’t do what it’s not supposed to.”
“When we start a threat model, as you said, it should be in the early stages of the project, but it does evolve and you continue doing it even after you released a product, you revise your threat model. It never ends actually.”
“If you don’t know your use cases, you cannot really come up with the abuse cases.”
“As we define threats, we think about confidentiality, integrity and availability. And these are security properties that we want to protect, and there are all kinds of ways to attack them.”
“These charging stations that have a USB port and you just stick a USB key. I never use them. How did you know what they’re going to load into your phone or a laptop when you’re trying to charge?”
“I think that’s where the real magic happens, when you have all these different pieces going together, because that raises the bar for an attacker. They would have to basically get all that information, which is hard, whereas a password they may be able to get, because you know, you reuse a password and then some website leaks all the passwords to the internet.”
“Adversaries are people. And we need to think not just about their skills, but also about their motives.”
“Security should be part of everybody’s job, and everything that you do you need to think, ‘Is there security impact to what you’re doing, even if it doesn’t seem like that in the beginning?’”