There are 5 key challenges for threat modelling in 2023. Has your organization run up against them yet?
In a 2019 survey, 42% of organizations that had experienced an external attack blamed the incident on a software security flaw. In 2023, that statistic has risen to over 50%.
So how can teams overcome these challenges? Let's explore:
Software development teams know the importance of implementing “security by design” from the early stages of the SDLC. This approach, radically different from the security as an afterthought approach practiced earlier, focuses on proactively preventing cybersecurity breaches, rather than reactively remediating them, thus enabling dev teams to create secure software from the outset. One of the most effective ways to leverage the security-by-design approach early in the SDLC is threat modelling.
Threat modelling involves systematically analyzing, from an attacker’s perspective, any potential threats to the org’s applications, systems, or other assets like confidential data or intellectual property. In fact, continuous and consistent threat modelling using a model like STRIDE (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privileges) or PASTA (Process for Attack Simulation and Threat Analysis) are both efficient ways to strengthen any organization's DevSecOps culture, drive effective security measures, and lower remediation costs.
Even so, many organizations face challenges in implementing it in practice. Here are five of the most common.
Numerous threat modelling processes are available, frequently leading to confusion, especially for teams lacking an experienced security expert. This makes it difficult to judge the various processes and select the right one to drive cyber defence priorities.
The wrong choice can lead to inadequate or inappropriate cybersecurity investment. Equally worrying, it may lead to overconfidence in the organization’s security posture and risk mitigation capabilities, which increases its vulnerability to attacks.
Some teams also struggle to validate their threat model. When they don’t know how to effectively mitigate the threats they find, threats are left unaddressed, once again increasing the risk of attack. Process saturation is a particularly common hurdle for SMBs who may have more limited in-house resources.
Threat modelling is more accessible for simple, monolithic applications when there is little reliance on external entities, or when a consumable view of the computing ecosystem is available. But today’s applications are anything but simple.
As they’re scaled up and migrated to the cloud, the application team is often responsible for full-stack management. This is a complete departure from previous legacy deployments, where IT completely managed the application’s physical servers and networking infrastructure.
The threat model must account for these additional infrastructure-related responsibilities, scope changes, expanded topologies, and associated risks, which is not always easy for a Dev team to do.
Another of the most common challenges for threat modelling in 2023 is unrecognized entry points and trust boundaries.
With most cloud service providers, including popular ones like Amazon Web Services, many entry points are not recognized. These include publicly-exposed management APIs and services.
This means many entry points can be accessed from the Internet, including API gateways that allow cross-account invokes, Lambda functions that bad actors can invoke with Invoke IAM permission, S3 buckets with public endpoints, and attackers that can directly inject malicious events into the SQS event queue.
Consequently, the Data Flow Diagrams (DFDs) and Process Flow Diagrams (PFDs) used to model threats, and better understand how bad actors can gain access to an asset, are significantly more complex than they would be with known entry points.
An attacker who possesses a properly-permissioned authentication token can easily threaten a cloud service provider’s publicly exposed control plane. For example, in AWS, temporary authentication tokens are transferable and can be used outside the application environment.
An information leak can expose an authenticated session token to bypass security safeguards and mitigating controls, and provide a threat actor access to something they shouldn’t be able to access otherwise.
Thus, what was once considered a “low-risk” information leak now carries a higher severity, requiring appropriate representation and analysis in the org’s threat model.
Last but not least on our list of challenges for threat modelling is risk-predicting difficulties.
Even for the most well-equipped team, it can be challenging to determine high-level threats and break them into sub-threats that can be more easily addressed. Another challenging aspect is identifying the failure conditions that could lead to the realization of these threats. An understanding of these conditions can provide a deeper understanding of the likelihood and criticality of the threat and also support the organization's risk mitigation efforts.
A completed threat model should support risk mitigation, and provide the proper framework and techniques for robust application security testing, so the team can more effectively predict possible attack scenarios.
Over 70% of security vulnerabilities exist at the application layer. Due to this, threat modelling provides an effective way to lower the probability that they could compromise an organization's security posture.
Make threat modelling an invaluable part of your organization’s DevSecOps culture by getting your free, zero-obligation quote from our ethical hacking team here at Packetlabs.
August 15 - Blog
It's official: Packetlabs is a partner and attendee of Info-Tech LIVE 2024 in Las Vegas. Learn more about event dates and registration today.
August 01 - Blog
This article will delve into the most common techniques attackers use to transition from their initial breach to achieving their end goals: Privilege Escalation.
July 31 - Blog
Did you know? Attack attribution supports cybersecurity by providing contextual awareness for building an effective and efficient cybersecurity program. Learn more in today's blog.