Threat modeling is an intrinsic part of information security governance and needs to be done well. However, research finds that many organizations don't do it well, some are pretty haphazard or chaotic in their approach. In this episode, Marcos Lira, Lead Solutions Engineer at Halo Security, sheds light on how to do threat modeling the right way. The key questions driving the discussion were: a) what is the scope and purpose of threat modeling? b) what have people and organizations been getting wrong about threat modeling? c) what is the right way of doing threat modeling? and d) what is the future of threat modeling?

To access and download the entire podcast summary with discussion highlights --

https://www.dchatte.com/episode-41-do-you-see-what-attackers-see-threat-modeling-done-right/

Connect with Host Dr. Dave Chatterjee and Subscribe to the Podcast

Please subscribe to the podcast, so you don't miss any new episodes! And please leave the show a rating if you like what you hear. New episodes release every two weeks.

Connect with Dr. Chatterjee on these platforms:

LinkedIn: https://www.linkedin.com/in/dchatte/

Website: https://dchatte.com/

Cybersecurity Readiness Book: https://www.amazon.com/Cybersecurity-Readiness-Holistic-High-Performance-Approach/dp/1071837338

https://us.sagepub.com/en-us/nam/cybersecurity-readiness/book275712

Latest Publication: https://www.imd.org/ibyimd/magazine/preventing-security-breaches-must-start-at-the-top/

Welcome to the Cybersecurity Readiness Podcast

Series with Dr. Dave Chatterjee. Dr. Chatterjee is the author of

the book Cybersecurity Readiness: A Holistic and

High-Performance Approach, a SAGE publication. He has been

studying cybersecurity for over a decade, authored and edited

scholarly papers, delivered talks, conducted webinars and

workshops, consulted with companies and served on a

cybersecurity SWAT team with Chief Information Security

Officers. Dr. Chatterjee is Associate Professor of

Management Information Systems at the Terry College of

Business, the University of Georgia. As a Duke University

Visiting Scholar, Dr. Chatterjee has taught in the Master of

Engineering in Cybersecurity program at the Pratt School of

Engineering.

Hello, everyone, I'm delighted to

welcome you to this episode of the Cybersecurity Readiness

Podcast Series. The discussion today will focus on threat

modeling. Some of the questions driving the discussion are, a)

what is threat modeling? b) what is its purpose? c) what have

people and organizations been getting wrong about threat

modeling? d) what is the right way of doing threat modeling?

and finally, d) what is the future of threat modeling?

Marcos Lira, Lead Solutions Engineer at Halo Security joins

me in shedding light on this very important cybersecurity

governance topic. Welcome, Marcos.

Hi, Dr. Dave. It's a pleasure to be here. Thanks

for having me.

Thank you so much for making time. I know

this is gonna be an exciting session. And I know, listeners

will greatly appreciate your insights. So before we get into

the details of threat modeling, let's talk about you. Please

share with listeners some highlights of your professional

journey.

Absolutely! In preparing for the podcast, I was

doing some research. And it appears that you and I have a

similar background. We both started the it looks like in

finance. So I think you have a degree in accounting. Yes. And

my degree is in finance with the emphasis in financial planning

and taxation. And so the beginning part of my career, I

focus on financial planning, and tax preparation, whatnot. And

about 10 years ago, I decided to pivot to cybersecurity. And it

really happened with the transition of, you know, cloud

adoption and digital transformation in the finance

world. And so this was shortly after, you know, 2010, I began

noticing that a lot of my clients were required to, or

they were being asked by these financial institutions to

submit, you know, their credentials from another bank,

or brokerage, an insurance provider. And they were

aggregating this data on this one platform. I started thinking

to myself, I wonder what kind of security controls are in place,

because there's a lot of data being transferred around these

different institutions and different applications. And so

that got my interest in cybersecurity. And so yeah, the

rest is history. And I've been in the application security

space now for a little, about 10 years.

That's great to hear. And Marcos, I'm

glad you shared, you know, how you stumbled into this field, If

I may. And so did I. And, in fact, I want to take this

opportunity of encouraging many listeners who may not be in this

field, or, and are thinking about getting into this field

and wondering, do they have the right background to get in, my

message to them is, if you are curious, if you're excited, if

you're passionate if you want to learn if you're willing to

adapt, any field is great, including cybersecurity, so

don't hesitate to pivot. We don't have enough time to go

into my my story, so I'll save that for another occasion. But

cybersecurity can benefit from an eclectic influence -- people

with different perspectives needs to jump in. I did an

episode with a very senior leader of a major financial

institution; Okay, and he was emphatic about the importance of

leaders from other functions, getting into the security

function, and he felt that they need to make the security

function more attractive to draw great talent. So this is very

consistent that people from different backgrounds, business

and technical backgrounds are pursuing different activities

within the cyber security domain. So, anyhow, getting back

to our discussion topic threat modeling, Marcos, it might be a

good idea to share with the listeners, provide them an

overview of what threat modeling is, what it's purpose?

Absolutely. In the insurance world, before I

transitioned to cybersecurity; before you can assign a policy

to an individual, you conduct what's called risk analysis. And

you look at all this data, you start assessing the risk

associated with issuing a policy to particular individual or a

business, what have you. And so, during this process, they look

at various risks. And it could be credit, it could be where the

location of the business might be located, where the location

of, you know, for automobile insurance, where the location of

the automobiles are located, how often someone is driving, right.

And what they're doing is they're analyzing threats. And

so with this experience, I started taking a look at the

data that Halo Security provides, which is the

organization I work with. And I started noticing that we provide

a lot of data, which with context, is really threat

intelligence. And so it was data around the attack surface. And

that's when I started connecting the two -- risk analysis, the

data that we provide from an attackers point of view, it's

really threat Modeling, and this data can be utilized for threat

modeling. So what is threat modeling at a high level, it's

really analyzing risk to your assets. And during the threat

modeling exercise, what you want to do is identify threats,

identify any current security controls, any gaps, and at the

end of the day, assess, what are we currently doing, and is it is

efficient to protect our assets. And the asset can be customer

data. It can be, you know, other variations, but that's what

we're looking for. And at the end, it's customer data, or it's

just data in general, right data is the oil. And this century,

the world is powered by data, and data has been accumulating

at a faster rate.

That was a great explanation. To reiterate,

when done well, threat Modeling helps organizations identify

where the risks are, the different sources of risks, and

the types of assets that are vulnerable to the different

forms of threats. Rigorous threat modeling will ensure that

organizations engage in comprehensive asset discovery.

The Cybersecurity and Infrastructure Security Agency

CISA recently issued a directive requiring federal enterprises,

the civilian executive branch, perform automated and

comprehensive asset discovery every seven days. The directive

also requires federal enterprises to initiate

vulnerability, enumeration across all discovered assets

every 14 days. So, threat modeling is such an intrinsic

part of information security governance, and it is so

important that it's done well. However, my research finds that

many organizations don't do it well. Some are pretty haphazard

or chaotic about it. Some want to just focus on a few

applications and are hasty about it. Your thoughts?

Dave, you know, you can't make informed decisions

about business without threat modeling. And so what that means

is it really starts from the top level from the executive level,

down. In order to create a culture of security, it has to

come from leadership. And so if you don't understand the data

flow of your systems, you can't make informed decisions. You

can't decide how best to defend and secure customer data. And so

what most organizations get wrong is that they believe

threat modeling is going to slow the business down. And so what

has happened is that we've dedicated more more of the

resources. And this is what's been communicated to me in my

weekly, daily conversations with, you know, CISOs, CTOs,

leadership personnel, that their resources are spent on reactive

approaches. Right, because that's easier, that's easier to

communicate to the business, it's easier to communicate to

the Board of Directors. While in case of a breach, we have this

in place. And it's either going to contain or it's going to

defend. But they're very slow in in implementing a proactive

approach, which will be less costly over time. And that's

where threat modeling comes into play. It's a proactive approach.

It's going to help you from a business perspective, from a

leadership perspective, it's going to help the organization

decrease costs over time. Because threat modeling is going

to tell you where your gaps are. Right? It's going to identify

those gaps, and it's going to help you better focus those

resources in protecting and securing those gaps. And so

that's what most or most people get wrong about threat modeling,

is, it's time consuming, it's cumbersome. There's, it's so

it's confusing, because there's so many methodologies out there.

There's PASAT, there is DREAD, there's the Microsoft STRIDE

model, right, spoofing, tampering, escalation of

privileges, right, all these different methodologies. And so

they just put their hands up and say, wow, this is too confusing,

I don't know where to start. And let's just be, you know,

reactive, let's just defend. And so I think that's where

organizations get wrong, is it you think it's, it's very

difficult to implement, when in fact, it is not. We threat model

all the time. Dr. Dave, you've threat modeled in your day to

day without even realizing I threat model my day to day

without realizing. The example I've give my clients is, I just

have I just had a newborn, right. She's actually one years

old now. But as soon as I brought my newborn, my newborn

home, the first thing I did was threat model. I started

identifying all the possible threats from the doctor's, from

from the hospital, to my home, right? I get into my car, what

are the possible threats, Oh, the other drivers out there. So

I got to drive defensively, got to make sure my car seats placed

correctly, my baby's secured tightly. Right. When it comes to

the home, I'm gonna make sure my windows have all the proper

locks in place. My doors have all the proper locks in place,

and they are working functionally. Right. So we're

always thinking of the possible threats to an asset. And that's

really what the way organizations view threat

modeling is, well, let's start with what are we trying to

protect? What is an what do we consider an asset to the

organization? And let's start from there. And let's start

identifying the possible threats. So if you think of it

from that perspective, it shouldn't be very difficult

task.

Absolutely. What a wonderful example, when

you talked about being a parent, and trying to proactively gauge

different types of threats to your little daughter, you

essentially conveyed how caring and protective you are. It

really boils down to truly care about securing the enterprise,

the various entities and the relevant assets. You talked

about the different approaches to threat modeling. It could be

attacker centric, it could be asset centric, and it could be

software centric. You also mentioned the different threat

modeling methodologies, such as STRIDE, PASTA and DREAD. So

there's a lot of guidance out there, but that can be

overwhelming. and create confusion regarding what is the

right way to do threat modeling? Can you provide some clarity?

I think the threat modeling manifesto said it best.

And I think the right way of doing threat modeling, it's

answering four questions. In this, this is applicable at

every layer within an organization. And at every

domain, whether it's accounting, whether it's development,

whether it's IT, whether it's business, finance, right, is

what are we currently working on? What can go wrong? What are

we going to do about it? And if we did a good enough job. I

think that is the best approach to threat modeling, is starting

with those four questions. And again, this is applicable to any

layer, at any phase, within an organization. It does not have

to be only applicable on the eyes of development. So let's,

let's think about threat modeling in this context. I like

to use a an example. Think of the Capital One breach that

happened 2019. And the Capital One breach happened, not within

the Capital One network that they have control over. It

happened in a cloud infrastructure, whether it was

shared responsibility. And it happened because of insider

threats at the third party, which was the cloud

infrastructure. And so a lot of the times organizations think,

well, what are we doing? What are we working on? Well, working

on, you know, providing information to our customers

much faster. Okay, so we're going to transfer the

infrastructure of that compute power and the data storage and

what have you to in this case, it was AWS. Right? What can go

wrong? Well, what what's going on in the industry, and what's

happened in my conversation. And I assume what happened with

Capital One is that we're transferring risk, right? And

the thing is, we're not transferring all the risks,

we're transferring some of the risks. And that's why GCP,

Google Cloud, platform, AWS, and Azure all have a part of their

policy, part of their T's (terms) and C's (conditions) is

shared responsibility. Terms and Conditions. Right. And so what

happened with Capital One, with threat modeling could have come

into play, and it could have solved a issue that was

identified was encryption. Right? If Capital One had

encrypted the data, not just in transit, but also at rest, Yes.

Also at rest, right, if Capital One would have encrypted the

data, not just in transit, but also at rest, then it would have

been more difficult for the insider threat to create any

value from that data, right? It would have been useless. And so

that's where you can threat model against third parties. As

we stated earlier, there's there's many methodologies and

each methodology as their own methods of approaching threat

modeling, there are various steps. And the threat modeling

manifesto is, which is what I recommend to our clients. And

our process has been started thinking about implemented

threat modeling, is this simplified? Because you really

only need to answer four questions. Right? And so that

is, what are we working on? What can go wrong? What are we going

to do about it? And did we do a good enough job? In an example,

one of the authors of the manifesto, Adam Shustack, likes

to say, and I think it's a great example. So I'll utilize it here

is, imagine that you have an errand to run. And your phone is

at 20% as far as you know, targeting and charge the 20% and

it's going with battery life. And you have to run this errand,

you have an update, it's a critical update that you have to

run. And so you have, right what are we working on? Well, you

have this errand that you have to run. So you have to leave her

house. Okay. But you have to make the decision. And here's

the threat model comes in, is, do I leave my phone at home?

Charging done with the security update? Or do I take the phone

with me? Because, you know, an accident might happen, I might

need to fund for emergency reasons. That's a decision you

have to make. Right? So that's the, what can go wrong? What are

we going to do about it? Well, you have to make that decision,

right? Leave the phone here, I can take it with me. And the

last thing is, do we do a good enough job. So in this example,

the individual took the phone with him and said, Well, I'm

gonna use, I'm gonna take the phone with me in case of an

emergency, where I'm gonna wait to update the phone with the

security update until I get home. What's at risk, is that

maybe their data is exploited, that maybe, you know, some type

of attack can happen that because they're vulnerable, they

don't have the security updates. So they're vulnerable at the

moment. But that's the risk they decided to accept. Right? And so

did a good enough job. Well, at the end of the night, they were

able to update their phone. It wasn't compromised. And they

were they're good to go. So yes, they did a good enough job. And

so in short, threat modeling is, again, in that example, as as

far as it's just kind of simplifying it with, what are we

working on? What can go wrong? What are we going to do about

it, and did we do a good enough job is address the risk. And now

they had to answer whether they wanted to transfer that risk,

accept that risk, or the mitigating that risk or avoid

the risk which they can. So

Totally agree. Switching gears a little

bit, it's great to know that now, there are tools and

platforms available that facilitate collaboration, and

are very intuitive and easy to use. They help pull together

information from different places to one place quickly.

There are opportunities to customize. And last but not the

least, the reporting capabilities have improved

significantly. As a practitioner, what are your

thoughts about the future of threat modeling?

The future threat modeling, it's going to be it's

going to be more accepted conceptually. Right, because

again, we don't want to get bogged down by the the

intricacies of threat modeling. Because as organizations have

stated, It's too cumbersome. So it will be integrated within the

business as a concept in the way we do security, right? Think of

DevOps, right? The big push was security. And so you get

DevSecOps, right, is you want to code with security in mind. And

so that's the future threat modeling, is you want to build,

you want to move around your organization, with security in

mind. And that's where threat modeling is going to come into

play. It's going to be embedded within the culture of every

business and organization. As we get more comfortable with the

concept of threat modeling, which is really identifying

threats to an asset and understanding what are we

currently doing about it. It can be as simple as doing threat

modeling on a whiteboard, it doesn't have to be difficult.

And again, it can be implemented at every layer of the

organization.

Very true, very true. So we are kind of

coming to towards the end of our discussion. So I want to make

sure that we've covered all the important aspects, and I believe

we have, but for the benefit of the listener listeners, I'll go

through a few items that I have listed here. First and foremost,

we talked about how important threat modeling is. And I love

the way you put it, that threat modeling should be should not be

made into a cumbersome, you know, technically complex

process, it must be approached conceptually, it must be

approached simply, asking fundamental reflective questions

as to, it reminds me of an approach that an organization

used for many, many years, a major organization, they would

call it destroy your business approach DYB. And the CEO would

require the senior leadership during that quarterly meetings,

to make a presentation, where each product unit head had to

share scenarios that would kill that product line. And then they

would also have to present their action plans on how to

proactively avoid those situations. Now, this example

that I shared, this best practice that I shared, was in

the context of any business, it wasn't particularly focused on

cybersecurity. But the underlying principle is so

applicable that you have to be able to constantly do this

threat analysis, threat scenario analysis, and use that analysis

to identify areas for improvement areas for

weaknesses. And then, wherever appropriate, bring in the

relevant tools, often it's a combination of tools, processes

and people. Another thing that you you mentioned, which is so

important, that threat modeling should never be undertaken in a

siloed manner. It should start, if you look at the software

development lifecycle, it should be embedded in the lifecycle

through all the phases, starting with the design, I love the way

you explained DevOps security, that security by design,

security, should be built into the design and development of a

system by default. And that's when an organization has started

to really institutionalize threat modeling. You know,

that's, that's where we need to we need to go. The good news is

that many of the threat modeling tools that are available today

are open source. And they provide amazing capabilities.

For instance, one is able to gather threat intelligence from

the different threat libraries. They offer dashboards, that

shows data from threat intelligence and offer

mitigation options. They can be they can be scaled up to meet

business needs. They integrate very well with the business

infrastructure. And last but not least, they offer very robust

reporting capabilities. I would never recommend a particular

platform over the other. That is never the intent of this

episode. In fact, that undermines the credibility of

this episode. But what I always like to do is in collaboration

with my subject matter expert guest, today, we have Marcos,

I'd like to offer guidance to organizations when they're

trying to make this call. And that guidance is especially

relevant because while you can hire third party expertise for

threat modeling, but considering how intrinsic how centric threat

modeling is to overall security governance, it is imperative

that an organization develops in-house competency in-house

capability, as opposed to oh, this is something we don't want

to deal with. Let's get an outside vendor do it for us.

That doesn't serve the purpose. And so I would strongly urge

organizations to make that investment in people, in

process, in technology, to develop threat modeling skills,

capabilities in-house. But having said that, I'll pass it

over to Marcos. Marcus, please share your final thoughts and

help us wrap up the episode for today.

Yes, Threat Modeling is you know, it is a

concept. It's a process. It's applicable to every layer, every

domain of an organization. It should not be relied on, purely

on automation, purely on a software tool, it has a manual

component to it, you gotta you know, in order to think of all

the possible threats out there, you know, you got to take an

attackers perspective. The next point I wanted to make is threat

modeling for assets that you know of, it's easier. But for an

organization, you got to think about the assets that you have

forgotten, that have been misconfigured over time, that

have been poorly managed over time. And I think it's more

important now than ever to threat model against those

assets. And in order to really have an understanding of the

attack surface, you do need a attack surface management tool.

And the first part of the attack surface management tool, or the

foundational layer of that is discovery. And that's where

reconnaissance comes into play. Right? Reconnaissance is the

first step of the cyber kill chain, we think of from an

attackers point of view. You think of NIST, it's identify,

right, you have to identify what's on your attack surface.

That's the only way that you can defend against those assets. And

so threat modeling, the very first step is reconnaissance is

discovery. It's identify all the assets on the attack surface,

and then model against those assets. Right, well, possible

threats. And maybe you avoid the threat. And by avoiding the

threat, I mean, you take down the asset, and the asset does

not serve a purpose, it does not need to be on the attack

surface. So you take that asset down. Right? That is one of the

best approaches, is reducing the attack surface, this is gonna

make a lot, this is gonna make threat modeling much easier.

When you start thinking of data flows, the world is now powered

by API's. And we're moving from a culture of everything's

housed, everything is the infrastructure is in-house to

everything is as-a- service, software as a service,

infrastructure as a service, when you got to start thinking

of the possible threats along those connections, because now

we're connecting to what we call trust boundaries. Right, my data

that comes in from a source that I have full control over, maybe

will utilize a CRM for Salesforce. And so now I have a

third party that's providing me software as a service. And we're

transferring our customer data to that CRM. Well, that's PII

that's hosted at a third party. So now I got a threat model

against that third party. And so threat modeling, it's not just

for your organization, it should really be expanded to all the

trusted boundaries you have along your network. And so, yes,

I would. So my takeaways are, again, you know, utilize a an

attack surface management solution to identify all the

assets on the attack surface. Second, reduce or in this case,

avoid risk by reducing the attack surface. And then lastly,

apply threat modeling, to the assets that remain on the attack

surface, this process will become much easier, you will be

able to identify your gaps much faster, identify weaknesses,

identify vulnerabilities. It's all going to be much faster once

you have an understanding of what's out there, what are the

attackers seeing from their perspective?

Fantastic. Well, I really appreciate your

time Marcos. It's been a pleasure having you on this

episode, and I look forward to many more interesting

conversations. And I know listeners greatly appreciated

your insights. Thank you again. A special thanks to Marcos Lira

for his time and insights. If you like what you heard, please

leave the podcast a rating and share it with your network.

Also, subscribe to the show, so you don't miss any new episodes.

Thank you for listening, and I'll see you in the next

episode.

information contained in this podcast is for

general guidance only. The discussants assume no

responsibility or liability for any errors or omissions in the

content of this podcast. The information contained in this

podcast is provided on an as-is basis with no guarantee of

completeness, accuracy, usefulness, or timeliness. The

opinions and recommendations expressed in this podcast are

those of the discussants and not of any organization