Application Threat Modeling is a structured approach to analyzing the security of an application by identifying, quantifying, and addressing associated security risks.

This process helps integrate security from the very early stages of the software development lifecycle.

Application Threat Modeling: The Phases

1. Application Decomposition

It begins with understanding the application and its interactions with external entities. This involves creating use cases to analyze how the application is utilized, identifying entry points where a potential attacker could interact, and pinpointing assets that might be of interest to an attacker. Furthermore, trust levels are identified, representing the access rights granted to external entities.

This information is documented and used to produce Data Flow Diagrams (DFDs) that show data paths through the system, highlighting privilege boundaries.

2. Threat Identification and Classification

Once the application has been decomposed, the next step is to determine and classify threats. This is done using methodologies such as STRIDE, which helps identify threats based on common attacker goals, such as spoofing, data tampering, and denial of service. The identified threats are further analyzed to understand their potential impact and the ease with which they can be exploited, creating a prioritized list of threats to mitigate.

3. Determination of Countermeasures

After identifying the threats, it is essential to establish the countermeasures to be implemented to mitigate the associated risks. These countermeasures may include security controls, changes to the application design, or the removal of features that present risks that are too high. In some cases, it may be acceptable to accept the risk if the countermeasures are too costly or complex to implement, provided the risk is documented and managed appropriately.

Attacker-Centric Approach

Modern threat modeling adopts an attacker’s point of view, seeking to identify how a malicious actor could exploit system vulnerabilities.

This shift in perspective has made threat modeling an even more effective tool for improving application security. Application Threat Modeling allows for anticipating attacker moves and proactively strengthening defenses.

Integration into Code Review

Although threat modeling is not specifically a code review technique, it complements the process by providing context and risk analysis.

The results of threat modeling help guide the code review, focusing attention on the highest-risk areas. In this way, critical vulnerabilities are identified and resolved before the application is released.

🔙 Return to the ISGroup SRL mini-series dedicated to Code Review!