TMIS Quiz Flashcards
(32 cards)
What is the primary purpose of threat modeling in the application development lifecycle?
The primary purpose of threat modeling is to identify and manage application threats in a structured manner, preventing security flaws and reducing risks effectively.
What are the four main steps involved in the threat modeling process?
The four main steps are: Diagram the application, Identify threats, Mitigate identified vulnerabilities, and Validate the previous steps and act upon them.
What does the acronym STRIDE stand for in the context of threat identification?
STRIDE stands for Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, and Elevation of privilege.
During which phase of the application lifecycle is threat modeling typically performed?
Threat modeling is typically performed during the design stage of a new application.
What is a key advantage of performing threat modeling early in the development process?
A key advantage is preventing security flaws when there is time to fix them, specifically in the design phase.
Name two categories of threat actors.
Two categories are: Insider trusted (privileged users) and External untrusted (competitors, cybercriminals). (Other valid answers include: Insider untrusted, External trusted).
What is a “doomsday scenario” in threat modeling, and what is its purpose?
A doomsday scenario is a hypothetical worst-case situation for an application and business. Its purpose is to proactively anticipate and potentially prevent catastrophic events.
What is a data flow diagram (DFD), and how is it useful in threat modeling?
A data flow diagram is a graphical representation of data flow through an information system. It’s useful in threat modeling for understanding the application, identifying where data comes from and how it’s processed, and serving as a foundation for the STRIDE stage.
What is a “trust boundary” in the context of DFDs for threat modeling?
A trust boundary represents a change of trust levels as data flows through an application, indicating attack surfaces where an attacker can interject.
For which types of applications is threat modeling most relevant?
Threat modeling is most relevant for important applications that bring in a lot of revenue or handle important data for an organization.
What is threat modeling and why is it important?
Threat modeling, also known as Architectural Risk Analysis, is a structured activity for identifying and managing application threats. It’s considered an essential step in the development lifecycle, particularly during the design phase. Without threat modeling, security protection is described as a “shot in the dark.” It allows for finding vulnerabilities early, considering security implications of design, code, and configurations, and documenting and discussing these aspects. Performing threat modeling early is emphasized as an effective way to reduce risks.
When should threat modeling be performed during the application development lifecycle?
Threat modeling should be performed as soon as possible in the application development lifecycle, ideally during the design stage of a new application. This timely approach is crucial because it allows for preventing security flaws when they are easiest and least expensive to fix. While security issues can arise in different phases (design, build, test, production), starting with threat modeling in the design phase provides a foundational understanding of potential vulnerabilities.
Explain “diagram the application”.
This initial step involves gaining a comprehensive understanding of the application’s mechanics, including what is being built and identifying clear security objectives. This helps in uncovering relevant and detailed threats.
Explain “identify threats”.
Using details from the diagramming phase, threats relevant to the application’s scenario and context are identified. The STRIDE methodology (Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege) is a common tool used in this step to systematically identify potential vulnerabilities.
Explain “mitigate identified vulnerabilities”.
In this step, the application’s layers are reviewed to identify necessary security controls that address the identified threats. Vulnerability categories can help focus on areas more prone to mistakes.
Explain “validate”.
The final step involves validating the entire threat model. This includes confirming whether each threat has been mitigated or if the residual risks of unmitigated threats are clearly explained and tied to business risks. This step also involves deciding and following up on the next actions to manage the identified threats.
Beyond the technical analysis, what other aspects are important for comprehensive threat modeling?
- The ecosystem
- The business context
- Business risks
How are data flow diagrams (DFDs) used in threat modeling?
Data flow diagrams (DFDs) provide a graphical representation of the data flow through an information system, offering a common understanding of the application. They are particularly useful in the diagramming stage of threat modeling (Step 1) and serve as a foundation for the threat identification stage (Step 2, including STRIDE). DFDs help identify where important data originates, how it is processed, and where it is stored.
Name key elements in a DFD for threat modeling.
- External entities
- Processes
- Data stores
- Data flows
- Trust boundaries
What are the benefits of conducting threat modeling?
- Preventing security flaws early
- Selecting appropriate mitigation strategies
- Identifying and addressing the greatest risks
- Prioritizing development efforts
- Increasing risk awareness and understanding
- Facilitating consensus and better trade-off decisions
- Communicating results
- Cost justification and support for controls
- Documenting due diligence
For which types of applications is threat modeling most relevant?
What are the three primary views of Threat Modeling according to the source material?
While beneficial for all applications, threat modeling is particularly relevant and valuable for important applications. These are typically applications that generate significant revenue for an organization or handle sensitive and critical data. The time and cost investment in threat modeling are most justified for applications where the potential impact of a security breach is high.
What are the three primary views of Threat Modeling according to the source material?
The three primary views are Attacker (A), Architecture (A), and Assets (A).
Explain the fundamental definition of a “Model” as presented in the material.
A model is defined as an abstraction from real-world phenomena, developed to reduce overall complexity by aggregating information and documenting only relevant aspects.
