Threat Modeling

Identifying potential cybersecurity risks

As you know, digital security risks are growing explosively. But how do you know which risks pose the biggest threat to your organization? Secura’s Threat Modeling helps you to identify potential threats before they materialize. That way you can develop strategies to prevent or mitigate them.

Methodologies we use

Secura uses a number of recognized methodologies to perform Threat Modeling. These are the methodologies we use most often:

STRIDE

STRIDE is a well-known threat modeling technique. It focuses on six threat categories: Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege. STRIDE was introduced by Microsoft and has gained popularity due to its effectiveness and simplicity.

MITRE’s ATT&CK™

The MITRE’s ATT&CK™ framework is a continuously evolving model used to understand the tactics and techniques employed by adversaries. The tactics and techniques detail specific actions previously executed by attackers, providing a comprehensive understanding of potential threat behaviors.

Unified Kill Chain

Cyber attacks are typically phased progressions towards strategic objectives. The Unified Kill Chain provides insight into the typical phases of attacks. The Unified Kill Chain combines and extends existing models such as Lockheed Martin's Cyber Kill Chain® and MITRE’s ATT&CK™. The model was developed by Paul Pols, Secura’s ransomware resilience lead.

Attack trees

Attack trees provide a hierarchical representation of attack paths, starting from a high-level goal and branching out into specific attack steps. Each step represents a potential attack vector or vulnerability. By constructing attack trees, you can assess the likelihood and impact of various attacks, prioritize mitigation efforts, and identify critical security controls.

Other methodologies

We might use other methodologies that are more relevant to a specific sector. For instance, we developed our own high-quality methodology for the automotive sector and product manufacturing. The specific methodology for your project will be determined during the preparation phase, in consultation with you.