An implementation of threat modeling using threat dragon

1. Threat Modeling
Cloud Security Team

2. Overview
A conceptual exercise that aims to identify
security related flaws in the design of a
system, and to identify modifications or
activities that will mitigate those flaws.

3. OWASP Top 10
A04:2021-Insecure Design is a new
category for 2021, with a focus on risks
related to design flaws. If we genuinely
want to "move left" as an industry, it calls
for more use of threat modeling, secure
design patterns and principles, and
reference architectures.

4. STRIDE

5. Focus On
● What are we working on?
● What can go wrong?
● What are we going to do about it?
● Did we do a good job?

6. Threat Model Template

7. Stride - Controls

8. Implementation

9. Threat Dragon
● Supported by the Open Source
Community and OWASP
● Authentication handled by gitlab
and/or github
● Outputs a human readable json file
stored with source code

10. Simple Example

11. Risk(s) & Mitigation(s)

12. Storage

13. Dev Team

14. In Real Life
● One threat model for overall product architecture
● A threat model per “application” or set of functions
● Managed by the “Security Champion” role on dev team
● Reviewed at start of sprint with work items that cause
architectural change

15. S-SDLC

16. Resources
https://owasp.org/www-community/Threat_Modeling#

17. Thank You