Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Application Security

11/20/2020
02:45 PM
50%
50%

Security Pros Push for More Pervasive Threat Modeling

With the release of the "Threat Modeling Manifesto," a group of 16 security professionals hope to prompt more companies to consider the threats to software.

During a threat modeling exercise for a large development team, hacker and security advocate Alyssa Miller was floored when a developer commented that it would be great when the team moved to a DevOps software development framework.

The misconception? That threat modeling would no longer be required under an agile software development methodology. Yet the discipline is widely applicable to every aspect of business, including development and DevOps software life cycles, Miller says.

Related Content:

Threat-Modeling Basics Using MITRE ATT&CK

The Changing Face of Threat Intelligence

New on The Edge: ISP Security: Do We Expect Too Much?

"The attitude of a lot of organizations is that they look at DevOps as incompatible with threat modeling because threat modeling is traditionally seen as this giant, onerous task," she says. "But if you understand the purpose of threat modeling, you can streamline it and do it in a different way that it fits in DevOps."

On Nov. 17, Miller and 14 other security professionals published the "Threat Modeling Manifesto," a document spelling out the general principles of how best to consider attack vectors on software. As a blueprint, the document uses the style and content of the "Agile Manifesto," a statement published by 17 developers nearly two decades ago that set out simple and elegant goals for agile software developers. 

The threat modeling advocates aim to simplify the discipline to its essential concepts in hopes of making threat modeling more popular, says Chris Romeo, CEO of Security Journey, an application security training program.

"The whole point is to try to solve this common problem — what are the principles that we use to drive threat modeling in our daily practice?" he says. "It is not a how-to guide. It is not methodology-specific. It is about how we get people to understand threat modeling and implement it in their organizations."

The original "Agile Manifesto" came out of the principles behind a number of development methodologies, such as scrum and pragmatic programming. The "Threat Modeling Manifesto" distills current application security processes for agile software down to four basic questions: What are we working on? What can go wrong? What are we going to do about it? Did we do a good enough job? 

In addition, the manifesto attempts to focus developers on five values — security culture, a focus on people, treating security as journey, continuous refinement, and modeling threats — rather than talking about the process.

"We believe that following the guidance in the Manifesto will result in more effective and more productive threat modeling," the group stated in the document. "In turn, this will help you to successfully develop more secure applications, systems, and organizations and protect them from threats to your data and services. The Manifesto contains ideas, but is not a how-to, and is methodology-agnostic."

Businesses that avoid regular threat modeling put themselves at an increased risk of compromise. Many companies put threat modeling — or, more specifically, digital footprint or attack surface identification — behind both indicators of compromise and threat intelligence in terms of importance, according to the "2020 SANS Cyber Threat Intelligence (CTI) Survey."

By simplifying threat modeling, the security group hopes to make it more likely that businesses — and particularly developers — will include threat models in their processes. Miller recommends that developers and application security teams write information about threats in plain language in the user story. 

"Now it all comes together into the software development pipeline, where it all flows to the various components of DevOps," she says. "It is all about continuous improvement anyway. We know that one practice is not going to secure the world, but we want to make sure that we are a little bit better tomorrow than we are today."

Because developers outnumber application security professionals (some experts put it at 100 to 1), threat modeling has to be done by more than just the application security team, says Security Journey's Romeo. 

"We think threat modeling is the biggest bang-for-the-buck type of activity that you can do in application security," he says, "We all agree that threat modeling is something that the developers have to do. There is no way that application-security teams can do all the threat modeling."

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT's Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Commentary
Ransomware Is Not the Problem
Adam Shostack, Consultant, Entrepreneur, Technologist, Game Designer,  6/9/2021
Edge-DRsplash-11-edge-ask-the-experts
How Can I Test the Security of My Home-Office Employees' Routers?
John Bock, Senior Research Scientist,  6/7/2021
News
New Ransomware Group Claiming Connection to REvil Gang Surfaces
Jai Vijayan, Contributing Writer,  6/10/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: Zero Trust doesn't have to break your budget!
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-31476
PUBLISHED: 2021-06-16
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.1.3.37598. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the han...
CVE-2021-31477
PUBLISHED: 2021-06-16
This vulnerability allows remote attackers to execute arbitrary code on affected installations of GE Reason RPV311 14A03. Authentication is not required to exploit this vulnerability. The specific flaw exists within the firmware and filesystem of the device. The firmware and filesystem contain hard-...
CVE-2021-32690
PUBLISHED: 2021-06-16
Helm is a tool for managing Charts (packages of pre-configured Kubernetes resources). In versions of helm prior to 3.6.1, a vulnerability exists where the username and password credentials associated with a Helm repository could be passed on to another domain referenced by that Helm repository. This...
CVE-2021-32691
PUBLISHED: 2021-06-16
Apollos Apps is an open source platform for launching church-related apps. In Apollos Apps versions prior to 2.20.0, new user registrations are able to access anyone's account by only knowing their basic profile information (name, birthday, gender, etc). This includes all app functionality within th...
CVE-2021-32243
PUBLISHED: 2021-06-16
FOGProject v1.5.9 is affected by a File Upload RCE (Authenticated).