Introduction to threat modeling
Threat modeling is a process of analyzing the system as a whole during the design phase of the software development life cycle (SDLC) to identify risks to the system proactively. Threat modeling is used to think about security requirements early in the development cycle to reduce the severity of risks from the start. Threat modeling involves identifying threats, understanding the effects of each threat, and finally developing a mitigation strategy for every threat. Threat modeling aims to highlight the risks in an ecosystem as a simple matrix with the likelihood and impact of the risk and a corresponding risk mitigation strategy if it exists.
After a successful threat modeling session, you're able to define the following:
- Asset: A property of an ecosystem that you need to protect.
- Security control: A property of a system that protects the asset against identified risks. These are either safeguards or countermeasures against the risk...
