Table of Contents

    About the Author

    Jon Matthews

    Jon Matthews

    Jon Matthews is a highly experienced and trusted leader in computer and network forensics with over twelve years of experience. He leads investigations around high-profile digital forensic and incident response matters helping clients determine the root cause and extent of breaches. Jon retired from the U.S. Army with over 20 years of service. He was a Special Agent with U.S. Army Counterintelligence for nine years and specialized in digital forensics for espionage and APT investigations. Jon also worked with Aon's Cyber Solutions (Stroz Friedberg) leading their Washington, DC forensic lab and conducting digital forensic and incident response investigations for two and a half years. Education, Certifications, and Training: Jon holds a Bachelor of Science degree in Computer Networks Security from the University of Maryland University College, and holds a Graduate Certificate in Incident Response from the SANS Technology Institute. Jon was a certified Computer Crime Investigator while working in the U.S. Army. His certifications include being a CISSP, Certified Incident Handler, Certified Forensic Analyst, Network Forensic Analyst, Reverse Engineering Malware, Advanced Smartphone Forensics, Certified Ethical Hacker, Secure Infrastructure Specialist, A +, Network +, and Security +.

    More Articles

    Additional Resources:

    CrowdStrike, SentinelOne, and MS Defender: The EDR Trio Powering CyberMaxx’s Advanced Threat Detection

    CrowdStrike, SentinelOne, and MS Defender: The EDR Trio Powering CyberMaxx’s Advanced Threat Detection

    Articles

    5 min read

    Behind the Alert: How EDR Use Behavioral Data to Detect Threats

    Behind the Alert: How EDR Use Behavioral Data to Detect Threats

    Articles

    6 min read

    Potential threats of hacking, cyber-attacks, and data breaches grow on a daily basis as more and more threat actors enter the game. Aside from the obvious financial damages, security threats can erode users’ trust in companies.

    Protecting a network can seem like a daunting task for an organization when security breaches can become a reality. The first step is understanding where those threats can come from. If you’re an engineer or developer, you probably know all too well how to exploit security vulnerabilities in software.

    This is where threat modeling comes in.

    What is Threat Modeling?

    Threat modeling evaluates a system or environment’s potential weaknesses and then designs solutions accordingly. In essence, threat modeling helps to identify potential threats specific to a company—both in terms of digital assets and physical vulnerabilities—and decide what actions should be taken to minimize or resolve them.

    However, threat modeling is not just for big banks and tech giants anymore. It is a critical element of sound information security, crucial to every trade, business, and individual company no matter how large or small; all entities of any size could be breached.

    Threat Modeling: Process Process Process

    Security is an important consideration in any company’s development. Security should be a point of serious consideration and, not just an afterthought. Waiting until after the development is complete to address security, it can take a lot more time and money to go back and fix design flaws that could have been easily avoided early on.

    Threat modeling is a structured approach to assessing the risk that helps you understand what specific threats you need to consider when developing your application. Threat modeling helps you make more informed decisions about how to mitigate risk and secure your application against attack.

    The threat modeling process may include the following phases:

    • Identifying security requirements and designing a threat model for the application or computer system under review.
    • Analyzing the threat model and identifying potential threats, vulnerabilities, mitigations, and residual risk.
    • Developing a mitigation plan for the organization to follow during the design, implementation, testing, deployment, and maintenance of the application or system under review.

    Doing threat modeling is a lot like doing quality assurance. It’s a process in order to identify problems. If these problems are located earlier in the process, fixes can be identified sooner than later resulting in a proposed fix before the system is implemented.

    Why is Threat Modeling Essential?

    The security threat modeling process can help organizations and individuals deal with this growing epidemic in several ways: by providing them with a framework for identifying and understanding threats, crafting countermeasures to reduce the chance of future breaches, and helping them learn from past missteps.

    Security threats are a major concern for businesses of all sizes. What we need is an effective process to anticipate these risks and create plans to counter them.

    Threat modeling establishes a framework for analyzing how cyber threats can affect us, what assets they could target, and how we can mitigate their impact.

    To put it simply, threat modeling is a tool for combating cyber threats that are well worth learning about in this digital age–and hopefully, the further explains it below will help you begin to understand what an essential step it is to cybersecurity success.

    Threat modeling is a way of thinking that every security and privacy professional can use to create more secure systems by reducing vulnerabilities. It’s flexible, scalable, and repeatable. We expect that threat models will increasingly be adopted as the industry’s understanding of what they are and how they work matures.