Threat Model - Approaches To Threat Modeling

Approaches To Threat Modeling

There are at least three general approaches to threat modeling:

Attacker-centric
Attacker-centric threat modeling starts with an attacker, and evaluates their goals, and how they might achieve them. Attacker's motivations are often considered, for example, "The NSA wants to read this email," or "Jon wants to copy this DVD and share it with his friends." This approach usually starts from either entry points or assets.
Software-centric
Software-centric threat modeling (also called 'system-centric,' 'design-centric,' or 'architecture-centric') starts from the design of the system, and attempts to step through a model of the system, looking for types of attacks against each element of the model. This approach is used in threat modeling in Microsoft's Security Development Lifecycle.
Asset-centric
Asset-centric threat modeling involves starting from assets entrusted to a system, such as a collection of sensitive personal information.

Read more about this topic:  Threat Model

Famous quotes containing the words approaches to, approaches, threat and/or modeling:

    “I should say that the most prominent scientific men of our country, and perhaps of this age, are either serving the arts and not pure science, or are performing faithful but quite subordinate labors in particular departments. They make no steady and systematic approaches to the central fact.... There is wanting constant and accurate observation with enough of theory to direct and discipline it. But, above all, there is wanting genius.”
    —Henry David Thoreau (1817–1862)

    “A politician is a statesman who approaches every question with an open mouth.”
    —Adlai Stevenson (1900–1965)

    “Probably the only place where a man can feel really secure is in a maximum security prison, except for the imminent threat of release.”
    —Germaine Greer (b. 1939)

    “The computer takes up where psychoanalysis left off. It takes the ideas of a decentered self and makes it more concrete by modeling mind as a multiprocessing machine.”
    —Sherry Turkle (b. 1948)