Threat modeling identifies the types of threat agents that cause harm and adopts the perspective of malicious hackers to see how much damage they can do. We look beyond the typical canned list of attacks to think about new attacks or attacks that may not have otherwise been considered

Avoid four security sink holes with threat modeling

 Threat modeling defines your entire attack surface by identifying:

1. Threats that exist beyond canned attacks Standard attacks don’t always pose a risk to your system. Perform a threat model to identify attacks that are unique to how your system is built.
2. Where threat agents exist relative to the architecture Model the location of threat agents, motivations, skills, and capabilities to identify where potential attackers are positioned in relation to your system’s architecture.
3. Top-N lists, attackers, and doomsday scenarios Create and update your threat models to keep frameworks ahead of internal or external attackers relevant to your applications.
4. Components that need additional protection Highlight assets, threat agents, and controls to determine which components attackers are most likely to target.

 We recognize that every organization has a different risk profile and tolerance, so we tailor our approach to your needs and budget. Our holistic approach consists of two essential steps:

1. We review the system’s major software components, security controls, assets, and trust boundaries.
2. We then model those threats against your existing countermeasures and evaluate the potential outcomes.

Six benefits of threat modeling

 When you’re serious about security, threat modeling is the most effective way to:

• Detect problems early in the SDLC- even before a single line of code is written.
• Spot design flaws that traditional testing methods and code reviews might overlook.
• Evaluate new forms of attack that might not otherwise be considered.
• Maximize your testing budget by helping you target your testing and code review.
• Identify holes in your requirements process.
• Save money by remediating problems before releasing software and performing costly code rewrites.