Our threat modeling services cover a wide range of cases and can be applied both to existing or newly designed applications and systems:
1. Threat modeling session – a single workshop with key stakeholders (architects, developers, system administrators, and/or project owners).
2. Threat modeling consulting and implementation – analysis of the existing SDLC and suggestions on how to implement TM processes across all projects.
3. Threat modeling training – multiple workshops, remote or on-site, aimed at teaching “the security champions” to perform threat modeling by themselves.
4. Threat modeling supporting materials – TM sessions based on examples provided by the client, followed by a 20-30min video – a summary in the form of our “Instant Threat Modeling” series
5. Base threat models – for the most common components, such as an AWS infrastructure or a specific type of an API, a base threat model can be applied to all functions or systems that use this component.
Consuming threat modeling output
The best thing about threat modeling is raising awareness of potential threats and the ways to avoid them. The output consists of threats and may be converted into security requirements or test cases. It will be beneficial for:
1. project owners – to understand potential risks.
2. architects – in order to redesign the service and avoid risks
3. developers – to implement instant mitigations for discovered threats
4. security department – to define a scope for penetration tests and to measure test coverage
5. security testers – to focus on the key threats and understand the risk metrics
The added value of threat modeling
Implementing threat modeling in the SDLC process allows not only to avoid problems but also save time spent for the recovery of vulnerabilities. Patching vulnerabilities in the early stages of product development – a design or coding phase – requires much less effort than in a production phase. Some of the issues are impossible to remediate without redesigning the whole solution. The same applies to the testing stage – if a lot of potential problems have already been eliminated, the testing team needs less time for the basic issues and may focus on more in-depth problems.
If you are interested in modeling threats on the example of your IT solutions, please fill out our contact form.