Written by ND-ISAC Application Security Working Group in “Application Threat Modeling“, members of the National Defense Information Sharing and Analysis Center (ND-ISAC) offer a structured and systematic methodology to enable organizations to analyze the architecture, understand the flow of information, detect threats, and identify risk mitigation strategies using a proactive approach. This process is executed as early as possible to enable proactive visibility of the potential threats impacting the implementation before a single line of code is written. Application Threat Modeling is not a static process and requires multiple iterations as the architecture and its components change. The process is aimed at answering the following key questions in the architecture:
- What are we building?
- What can go wrong?
- What are we going to do about it
This white paper’s objective is to provide a high-level understanding of the importance of the Application Threat Modeling methodology and to explain the three steps involved in Application Threat Modeling. The paper also covers how to embed Application Threat Modeling in DevSecOps to create efficiencies using automation and provides an overview of the type of tools available in the industry to support stand-alone or cloud native processes.
The paper examines how to integrate the methodology in a DevSecOps pipeline, taking advantage of existing technology capabilities to not only create a map of the architecture but also integrate a feedback loop to help with planning remediation. Finally, a discussion regarding the types of tools available in industry to conduct Application Threat Modeling are introduced.
The audience for this white paper includes software and security engineers, and software and security architects responsible for the secure design of software implementations in the organization.
Download the White Paper here
For more information, collaboration on future releases, or if you are interested in becoming a member of ND-ISAC contact: info@ndisac.org