What are three ways that people might start threat modeling.
A percentage of your grade is based on your posts on the Discussion Boards. You must post at least three times. One post should be your response to the questions posed in the discussion board, should be a minimum of 300 words, and should be posted no later than Thursday to give peers an opportunity to reply. The other post should be a thoughtful response to another student’s post, and should be a minimum of 100 words. In addition to the questions below, feel free to talk about any personal experience, thoughts, or ideas that are related to the discussion.
1- Why do we create models? (Provide two explanations)
2- What are three ways that people might start threat modeling.
REQUIREMENTS
school discussion school information technology school IT school computer science school CSE school Security Architecture and Design
Here are the posts. Please provide replies to those two.
POST 1:
1- Why do we create models? (Provide two explanations)
The classic definition for threat modeling says, a structured process of identifying the threats and devising mitigation strategies for addressing the threats (Techopedia, n.d.). The reason for performing threat modeling are as below (Debarghya, 2018)
Identifying vulnerabilities and security flaws early in the design phase of the application/system design so that there is ample time to address them
Essential to building a highly secure application starting from the design phase and closes the gap between the developers and security engineers
Creates a detailed knowledge base of potential threats and mitigation plans for each threat.
Finally, by preventing attacks, saves time and money for the enterprise
2- What are three ways that people might start threat modeling?
Asset-centric modeling
Assets are any valuable things that the company cares about. It has an overlapping definition covering three ideas namely, things we protect (company’s reputation, customer information), things the attacker wants (security keys, confidential data, credentials) and stepping stones (CPU hardware, network vulnerabilities, weak firewalls) (Shostack, 2014). In this approach first step is to come up with a list of assets that matters to the company and it makes sense to continue with this approach if this list provides insightful directions to develop threat modeling. Otherwise, we are not reducing the risk of an attack by following this approach
Attacker-centric modeling
This approach involves putting yourself in the shoes of an attacker and think like an attacker. Most commonly Attacker lists are developed and used by security experts to model the threats. The issues here are we cannot give reproducible results as we cannot always predict what an attacker might do, with our own biases and theories. If we were wrong about what an attacker might do, the model becomes useless.
Software-centric modeling
This approach devises threat modeling right from the level of software development. This is the most effective way as we are infusing security at the development stage itself. There are different ways diagrams can be used to create software models, example: UML, state diagrams, system architecture diagrams, API layouts etc. that fall under the umbrella term Data Flow Diagrams (DFD) that shows the flow of information on a higher level without getting bogged down by the details
************************************************************************************************************************************************
post 2: 1.Why do we create threat models?
Ans. Building models urges us to comprehend the issue. One goal for a building models is to create a model focused on the interrelationships between geographic, monetary, political, and social parts of the area system.
For instance, analysts use models since Models have distinctive utilizations – from giving a strategy for unveiling complex data to appearing as a hypothesis. There may be more than one model proposed by specialists to elucidate what may happen explicitly conditions. Consider a model exhibiting the Earth – a globe. Until 2005, globes were simply depiction portrayal of what we thought the planet looked like. In 2005, the principal globe using satellite pictures from NASA was conveyed. The globe in 150BC was worked in Greece so perhaps simply exhibited a little proportion of land in Europe, and it wouldn’t have had Australia, China or New Zealand on it! As the proportion of data has grown over quite a long while, the model has improved until, when a globe created utilizing certifiable pictures was conveyed, there was no detectable qualification between the depiction and the real thing.
Another precedent is that in a couple of conditions, models are made to endeavor and foresee things. The best precedents are climate models and ecological change. Individuals haven’t the foggiest about the full effect they are having on the planet, anyway we do know a lot about carbon cycles, water cycles and atmosphere. Using this information and an appreciation of how these cycles participate, researchers are trying to understand what may happen. For show, they can use data to foresee what the environment may take after in 20 years if we keep conveying carbon dioxide at force rates – what may happen in case we make more carbon dioxide and what may happen in case we make less. The results are used to exhort government authorities about what could happen to the climate and what can be changed.
2. What are three ways that people might start threat modeling?
Ans. Danger displaying can be seen in two extraordinary, yet related settings. One is the execution of security controls by draftsmen that guide to security necessities and strategy. The other is to mirror all conceivable known assaults to segments or resources, with the objective of executing countermeasures against those dangers. From these two settings, four ways to deal with risk demonstrating emerge.
Four Approaches to Threat Modeling:
Software-centric
Asset-centric
Attacker-centric
Threat-centric
1. Software-Centric Approach
This methodology includes the structure of the framework and can be represented utilizing programming engineering graphs, for example, information stream outlines (DFD), use case charts, or part graphs.
This strategy is ordinarily used to break down systems and frameworks and has been received as the true standard among manual ways to deal with programming risk displaying. A genuine case of a product driven methodology is Microsoft’s Secure Development Lifecycle (SDL) system. Both the Microsoft SDL and Threat Analysis and Modeling (TAM) devices picture the framework being dissected using DFDs.
2. Asset-Centric Approach
Resource driven ways to deal with risk demonstrating include distinguishing the advantages of an association endowed to a framework or programming information prepared by the product. Information resources are typically grouped by information affectability and their natural incentive to a potential aggressor, so as to organize hazard levels.
3. The Attacker-Centric Approach
Assailant driven ways to deal with risk demonstrating require profiling an aggressor’s attributes, range of abilities, and inspiration to abuse vulnerabilities. The profiles are then used to build up a comprehension of potential assailants who might be well on the way to execute explicit sorts of adventures. In light of the comprehension of potential assailants, associations can execute a suitable moderation methodology.
The aggressor driven methodology additionally utilizes tree outlines. Scratch components of this methodology incorporate concentrating on the particular objectives of an assailant, the different contemplations identified with the framework whereupon the assault could be executed alongside its product and resources, how the assault could be completed, lastly, a way to distinguish or alleviate such an assault. An expert may likewise list related assault examples or ways to deal with make these equivalent judgments.
4. Threat-Centric Approach
The customary three ways to deal with risk demonstrating each have their legitimacy. Be that as it may, they yield a fragmented danger picture, from which CISOs and different partners would be tested to build up a start to finish security approach in the present profoundly interconnected digital biological community.
An increasingly exhaustive methodology is Threat-Centric. The risk driven methodology starts with three fundamental perspectives:
In the event that an IT situation is to be valuable, it must have, store, control, control, or generally use resources and enable clients to associate with those benefits. In a risk driven methodology, be that as it may, resources are no restricted essentially to information. Digital resources can likewise incorporate the framework’s capacities –, for example, the capacity to exchange assets starting with one record then onto the next, and physical frameworks controlled by the IT framework –, for example, involve a mechanical control or other digital physical frameworks. It is the digital resources – whatever they are or wherever they are found – that make an IT framework helpful.
Here are the posts. Please provide replies to those two.
Image preview for what are three ways that people might start threat modeling.
APA
593 words