Hacker News Reader

If you're looking for concrete resources with steps on how to perform threat modelling, I've used the Microsoft SDL Threat Modelling tool/process [1].

It's pretty Microsoft skewed (lots of references to Azure resources), but is a reasonable way to start thinking about the topic.

[1]: https://www.microsoft.com/en-us/securityengineering/sdl/thre...

View on HN

I really don't like it. Personally, I think it isn't hard to threat model your system:

1. break down your systems into smaller units

2. for each unit, figure out:

- what attackers are after (e.g. stealing a database)

- what attackers can do (e.g. infiltrate the network)

- what's the likelihood of each attack and scenario you can think about, along with the impact

- what you've done to prevent it (and is it good enough?)

- what you've done to detect it (and is it good enough?)

- what you would do to respond to a successful attack (and, is it good enough?)

Reply on news.ycombinator.com