Take Home Message Preview

1. We can threat model all kinds of things - including processes.
2. The threat modeling of threat modeling
   threat modeled threat modeling.
3. You can threat model your program, too!

Agenda for today

1. Threat Modeling
2. Threat Modeling of Threat Modeling
3. Threat Modeling of your Threat Modeling

Hendrik Ewerlin

• empowers people to build secure systems
• Developer → Cyber Security Architect
  at since 2010
• likes TM + E2EE + human-centered security
• likes philosophy + quotes + everyday wisdom

secure = protected from danger

danger = possibility of harm occurring

Shostack's
4 Question Frame
for Threat Modeling

1. What are we working on?
2. What can go wrong?
3. What are we going to do about it?
4. Did we do a good (enough) job?

Idea

Let's apply threat modeling
to threat modeling itself!

How to
threat model
a process

Usability
(ISO 9241-11:2018)

≈ how well your offer helps people
achieve their goals

Success

1. Effectiveness:
   achieved the goal
2. Efficiency:
   quality ↑ cost ↓
3. Satisfaction:
   🥰

Harm

1. Effectiveness Blocker:
   failed / stuck
2. Efficiency Inefficiency:
   💰💰💰 → 💩
3. Satisfaction Frustration:
   ☹️

(ISO 9241-11:2018 quotes)

• "Usability = extent to which a system, product or service can be used by specified users to achieve specified goals with effectiveness, efficiency and satisfaction in a specified context of use"
• "Effectiveness = accuracy and completeness with which users achieve specified goals"
• "Efficiency = resources used in relation to the results achieved"
• "Satisfaction = extent to which the user's physical, cognitive and emotional responses that result from the use of a system, product or service meet the user’s needs and expectations"

• secure the system.
• threat model "the right thing".
• find relevant threats.
• find appropriate mitigations.
• see mitigations implemented.
• [...]

We offer a process / program.

Will they achieve their goals?

Threat Sources

• We + others
• Lessons learned + foreseen threats
• Do generic threats apply to us?

Generic → Specific

• Generic activities → actual selected tools
  
• Generic actor → actual people and teams
  →

Take Home Message

1. We can threat model all kinds of things - including processes.
2. The threat modeling of threat modeling
   threat modeled threat modeling.
3. You can threat model your program, too!
   ... And this is what we do now!

Breakout Session Board

Prompts

1. When we threat model... What can go wrong? What are we going to do about it?
2. More specific:
   • When we start out...
   • When we discover threats...
   • When we plan mitigations...
   • When threat modelers communicate...
3. What didn't work? How did you fix it?

Session facilitators

(not in the presented slide deck)

Let's go!

▶️ Breakout Sessions

Results

The following slide has results after 22 minutes of collaborative Meta Threat Modeling in small groups. Zoom in to explore.

(not in the presented slide deck)

Insight sharing

1. What have you learned methodically?
2. What was a remarkable threat?

Take Home Message

1. We can threat model all kinds of things - including processes.
2. The threat modeling of threat modeling
   threat modeled threat modeling.
3. You can threat model your program, too!

More from Shuning