Threat Modeling for Company Networks: Step-By-Step Guide

Threat modeling helps you identify, understand, and mitigate threats within your company network. It uses hypothetical scenarios and system diagrams to map potential threats and devise the best ways to secure your data, applications, and systems. 

In today’s fast-evolving cyber threat landscape, network administrators struggle to stay ahead of cyber attackers, preempt major issues, and mitigate risks effectively. If conducted correctly, threat modeling empowers you to act proactively. It informs you how likely an attack is and what impact it would have.

Goals and benefits of threat modeling

Helps you understand your system's security landscape

Mapping your threats against your defenses enables you to pinpoint areas where your data and systems may be vulnerable. Maybe there's an old server with outdated security protocols. Identifying this allows you to focus on upgrading its defenses.

Realigns your security strategy

Not all threats are created equal. Most networks face potential threats from both phishing attacks and ransomware. Through threat modeling, you might find that phishing attacks are more likely and could lead to significant data breaches. This insight forces you to prioritize implementing stronger email filters and employee training programs over other measures.

Improves your incident response plans

Knowing what kinds of attacks are likely and where your weak spots are helps you prepare more effective responses. For instance, if you identify that your database is susceptible to SQL injection attacks, you can establish detailed steps for your response team to follow if an attack occurs. This could include immediate isolation of affected systems, detailed logging, and thorough investigation processes.

Supports your regulatory and compliance efforts

Many industries have strict data protection regulations. Conducting threat modeling exercises ensures your actions and policies align with these requirements. 

For example, in the healthcare sector, patient data protection is paramount. Threat modeling helps you identify compliance gaps and rectify them, thereby avoiding hefty fines and reputational damage.

Therefore, threat modeling equips you with a structured approach to analyze and bolster your defenses intelligently. It’s about being proactive rather than reactive and making sure you’re always one step ahead.

Threat modeling: step-by-step process

Step 1: Define security objectives

Security objectives are goals and constraints that affect the confidentiality, integrity, and availability of your data and application. Identifying security objectives is the first step you can take to help ensure the security of your application, and it's also one of the most important steps. 

Once you have defined your objectives, you can use them to direct subsequent security activities. Security objectives should be identified as early in the development process as possible, ideally in the requirements and analysis phase. That sets a foundation that helps guide your design and implementation choices.

Imagine you're developing an e-commerce application. During the requirements phase, you identify that protecting customer payment information is critical. This objective impacts how you design your database schemas, encryption methods, and authentication mechanisms.

Identifying security objectives is an iterative process. By the end of the requirements and analysis phase, you should have a first set of objectives that aren't yet tied to design or implementation details. As you move into the design phase, additional objectives will surface that are specific to the application architecture and design. 

For instance, you might decide that your application needs role-based access control to ensure that different users have appropriate permissions. During the implementation phase, more objectives may emerge based on technology or specific implementation choices, like securing API endpoints against potential injection attacks.

Each evolution of the security objectives will affect other security activities. You’ll need to review the threat model, architecture, design review guidelines, and general code review guidelines as your security objectives evolve.

One effective technique to discover security objectives is to create a roles’ matrix. If your system supports multiple roles, it’s crucial to understand what each role should be allowed to do. 

For instance, an admin role might have access to user management features, whereas a guest role might only have access to browse products. This matrix helps you generate security objectives to ensure the integrity of the application's role mechanism.

Another useful approach is to derive security objectives from functional requirements. Look at each functional requirement through the lens of confidentiality, integrity, and availability (CIA). 

Suppose your application has a feature allowing users to reset their passwords. For confidentiality, you would ensure that password reset tokens are securely generated and stored. For integrity, you would ensure that the reset process cannot be tampered with, and for availability, you would ensure that users can access the reset feature whenever needed.

Identifying critical assets and sensitive data

Critical assets can include patents, corporate financial data, customer sales information, human resource information, proprietary software, scientific research, schematics, and internal manufacturing processes.

For example, an ecommerce business might identify its website, inventory system, sales and accounts receivable system, and any proprietary products it produces, and interface with delivery systems, either electronic or physical.

You can identify critical assets using different methods. Risk assessments are a good starting point. You can also track assets through a service or hardware inventory. Network traffic monitoring can reveal the most frequently used network and system components.

Once you identify your critical assets, you must determine which ones are at the most risk of being attacked by authorized insiders and how these assets should be protected and monitored. 

From an insider threat perspective risks should be identified from privileged users, employees, contractors, trusted business partners, and others. The insider threat team should work in collaboration with other parts of an enterprise, such as human resources, risk management, information technology, and legal, to identify high-risk users who most often interact with these assets.

Although identifying critical assets is directly tied to an insider threat program, the asset inventory and tracking are not usually done by the insider threat team. Critical asset identification is usually conducted by a risk management group or similar team. 

Working with the critical asset owners, the risk or inventory team ensures it has the most up-to-date information about the assets. This information should then be passed to the insider threat team in a timely manner.

Step 2: Identify potential threats

Identifying potential threats entails figuring out what could go wrong. You need to think both like a defender and an attacker. Let's start with external threats. 

External threats are the boogeymen outside your network trying to get in. Hackers are the obvious example. These are individuals or groups who break into systems to steal data, disrupt services, or cause chaos. They can range from "script kiddies" who use pre-written code to sophisticated criminal organizations. 

Hackers might target your servers with a DDoS attack or try to brute force their way into your email systems. Phishing attacks are also common, where someone might try to trick an employee into giving up their credentials.

Remember the notorious ransomware attacks on companies like Colonial Pipeline? These were orchestrated by experienced hackers who demanded large sums of money to restore systems. Financial gain is usually their primary motive, but some hackers do it just for the recognition or thrill.

But not all threats come from outside. You also need to consider internal threats. These can be just as dangerous, if not more so because they often have the keys to the kingdom. 

An employee might accidentally download malware, or a disgruntled staff member could intentionally sabotage data. You also have to think about third-party vendors. They might have access to your network, and their security practices could open doors for attackers.

You should also consider the physical threats posed to your systems. Even with the best cybersecurity in place, if someone can waltz into your server room and plug in a malicious device, you're in trouble. Natural disasters like fires or floods can also pose a risk to your physical hardware and data.

Then there are the less obvious threats like software vulnerabilities. Maybe you're running outdated versions of software with known security flaws. These bugs can be goldmines for attackers. Zero-day exploits can be particularly scary because they're vulnerabilities that are not yet known to the software developers.

You should also consider social engineering threats. This is where attackers manipulate people into breaking normal security procedures. 

Imagine a scenario where someone poses as IT support to get an employee to share their login details. Or they might leave a USB stick labeled "Confidential" in the parking lot, hoping someone picks it up and plugs it into their computer out of curiosity.

Finally, we should add the malicious actions of competitors. Yes, business rivals can be threat actors too. They might engage in espionage to steal trade secrets, customer data, or intellectual property. 

Corporate espionage can cripple a company by eroding its competitive edge. A real-world example is the case of Uber and Waymo. Uber was accused of stealing self-driving car technology from Waymo, its competitor, which led to a highly publicized legal battle.

These threat actors—hackers, insiders, and competitors—each bring unique challenges. Understanding their motives and methods is crucial for developing robust cybersecurity strategies. By staying vigilant and proactive, you can better protect your digital assets from these various threats.

Threat vectors in company networks

Email has always been a major attack vector. It’s the source of many phishing attacks, where attackers pose as trusted contacts to trick you into revealing sensitive information. 

It's not just about phishing though. Email attachments can carry malware payloads. If you open the attachment, you could unknowingly install ransomware or a Trojan on your system. This is why it's so critical to train employees to recognize phishing attempts and ensure that your email filtering systems are robust.

Your website or the web applications you run is another potential playground for attackers. SQL injection attacks are common here. Attackers can inject malicious SQL queries to manipulate your database and extract sensitive information. They could exploit flaws in your SQL code and retrieve customer credit card data. 

Another example is Cross-Site Scripting (XSS), where malicious scripts are injected into web pages viewed by users. This can lead to session hijacking or even the distribution of malware.

Remote access is another vector that's growing more exploited, especially with the rise of remote work. Attackers can exploit weak or default credentials on remote desktop services to gain unauthorized access. Once they’re in, they can move laterally across your network. 

VPNs are supposed to add a layer of security, but they can become liabilities if they aren't configured correctly or if they're using outdated encryption protocols.

Step 3: Develop threat scenarios

This step focuses on creating detailed threat scenarios. This involves imagining specific situations in which an attacker could exploit vulnerabilities in the system. The goal is to make these scenarios as realistic as possible.

To get started, you can use the STRIDE mnemonic to think about different ways an attacker might try to compromise the application. STRIDE stands for Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege

Let's say your application is a college library website. One scenario might involve a spoofing attack. An attacker could try to log in as a librarian using stolen credentials. In this case, you should think about how strong your authentication mechanisms are and what you can do to prevent unauthorized access.

Next, consider tampering, where an attacker might try to alter data in the system. Imagine they gain access to the database and change the status of books so that they appear as available when they are not. Here, you’d need to think about data integrity and how you can ensure the data remains unaltered without authorization.

For repudiation, imagine a user performing actions in the system and then denying them. For instance, a student might request a book and later claim they never did. In this scenario, you need audit trails that log actions and digital signatures to validate those logs.

Information disclosure is another critical area. An attacker could intercept data in transit between the web server and the database. They might capture sensitive information like student login credentials. Encrypting data in transit and at rest would be important countermeasures here.

Denial of Service (DoS), where an attacker floods the system with requests, making it unavailable to legitimate users is another potential threat you can imagine happening for real. The attacker might create a script that sends hundreds of fake login attempts per second. Implementing throttling and filtering mechanisms can help prevent this.

Lastly, consider elevation of privilege threats. Suppose a regular user discovers a way to gain librarian privileges, perhaps through a vulnerability. This could lead to significant breaches. Ensuring that the application runs with the least privilege necessary and implementing strict role-based access controls (RBAC) would be essential.

You can also use VAST (Visual, Agile, and Simple Threat) and PASTA (Process for Attack Simulation and Threat Analysis) methodologies to imagine the threat scenarios your network might face. 

Each of these methodologies has its strengths. STRIDE is great for structured analysis, PASTA gives you depth from an attacker’s viewpoint, and VAST aligns perfectly with Agile workflows. By combining insights from these methodologies, you can build a robust defense strategy tailored to your specific context and needs.

Step 4: Assess risks and impact

Assessing risks and impact involves understanding what threats can actually do to your network and how bad things can get. It looks at both the likelihood of an event happening and the severity of its consequences. 

First, consider the likelihood of a threat event. Not all vulnerabilities are created equal. Some are more likely to be exploited than others. For example, if you have an outdated version of a popular software with known exploits, there's a good chance it could be targeted. 

On the other hand, if you have a custom-built application that's not widely known, the chances might be lower. You have to weigh these factors and decide which threats to prioritize.

Now, think about the impact these threats could have. Some threats could cause minor annoyances, like slowing down your network or causing brief outages. But others could be catastrophic. 

Imagine if an attacker gained access to your customer database. The potential for data theft, loss of customer trust, and even legal penalties could be enormous. You need to categorize these impacts from low to high to determine how much damage they could do.

Let's say you identify a potential SQL injection vulnerability in your web application. The likelihood might be relatively high since SQL injection attacks are common. The impact could be severe because an attacker could retrieve or manipulate sensitive data. So, this would be a high-risk situation that you need to address urgently.

On the other hand, consider a potential DDoS attack on your website. While the chance of this happening is moderate, the impact might range from moderate to high, depending on your mitigation strategies. If you have good defenses in place, the downtime might be minimal. If not, it could cripple your online presence for hours or even days.

You should also look at insider threats. Suppose an employee with access to sensitive information decides to go rogue. The likelihood might be low, but the impact could be devastating. They could leak proprietary information, costing you your competitive edge. So, even low-likelihood events with high impact need attention.

It's also crucial to think about compliance requirements. For instance, if you're handling medical data, a breach might not just lead to financial loss but also hefty fines due to regulations like HIPAA. So, the impact assessment must include potential legal repercussions.

Assessing risk and impact is all about painting a clear picture of what could go wrong and how bad it could be. You look at both the likelihood and the impact to prioritize your efforts.

Each risk needs a careful and honest look, from common exploits like SQL injections to the rare but severe insider threats. Understanding these dimensions helps you make smarter decisions about where to focus your security resources.

Risk assessment frameworks

The two most applied frameworks for assessing risks are CVSS and FAIR. These frameworks serve different purposes and have unique strengths and limitations. 

CVSS (Common Vulnerability Scoring System) is primarily a vulnerability rating system. Imagine you discover a security flaw in your system. CVSS helps you rate the severity of that flaw on a scale from 0 to 10. The higher the score, the more critical the vulnerability. 

The score is calculated based on multiple factors. For instance, how easy it is to exploit the vulnerability, and the potential impact on confidentiality, integrity, and availability. 

A vulnerability with a score of 9.8 would be considered very high and should prompt immediate action. However, a vulnerability with a score of 6.5 might still be dangerous, depending on the context.

Speaking of context, CVSS doesn’t account for it effectively. The scores are great for getting a quick sense of severity, but they miss out on your specific environment. 

For instance, a vulnerability with a score of 8 might seem severe, but if it’s on a system with many layers of defense and limited access, the actual risk might be lower. Conversely, a lower-scoring vulnerability on a highly exposed system could pose a greater threat. 

That's why CVSS scores should be one part of a broader risk assessment strategy, maybe combined with the Exploit Prediction Scoring System (EPSS) for more insights.

On the other hand, the FAIR (Factor Analysis of Information Risk) model takes a different approach. It focuses on quantifying risks in financial terms. 

Say you estimate that a specific cyber incident could happen once every ten years and result in a $2 million loss. With FAIR, you break this down to an annual probable loss of $200,000. This way, you can weigh this potential loss against the cost of implementing security controls.

FAIR’s strength lies in its detailed, quantifiable analysis. It considers probable loss magnitude and frequency, making it easier to justify security investments to stakeholders.

Imagine explaining to your CFO that spending $100,000 on a security measure will likely save the company $200,000 annually. It's a conversation grounded in financial logic, which usually gets more attention than technical jargon.

However, FAIR is data-hungry. Implementing it means gathering extensive technical and financial data. It can be time-consuming, needing the cooperation of multiple teams. For example, you'd need data on potential production losses, incident responses, and more. Despite this, the granularity of the analysis makes it a go-to for comprehensive risk assessments.

While CVSS helps you prioritize vulnerabilities, FAIR translates risks into financial impacts. Each framework has its place. CVSS is excellent for immediate, tactical decisions, especially for remediation efforts. 

FAIR, on the other hand, is strategic, aiding in long-term risk management and financial planning. Depending on what's needed, both can be vital tools in your risk management arsenal.

Step 5: Mitigate and remediate threats

This is where your proactive strategies come into play. Think of this as your game plan to tackle the vulnerabilities head-on. The first task here could be patch management. 

Keeping your software and systems up-to-date is essential. You must install patches as soon as they become available. You should automate this process wherever possible, using tools like WSUS for Windows or even third-party solutions like Patch My PC for a more centralized approach.

Next, focus on network segmentation. What if a hacker gets through? You don't want them to have free rein across the entire network. By segmenting your network, you can contain intrusions more effectively. 

Take your finance department's servers, for example. By isolating these from the rest of the network, you can add an additional layer of security around your most sensitive data.

Now, consider your access controls. Strong user authentication and authorization policies are crucial. You should implement multi-factor authentication (MFA) across all critical systems. This will significantly reduce unauthorized access attempts. Also audit your user permissions regularly to ensure only those who need access have it.

Then there's endpoint protection. Each device connected to your network is a potential entry point for threats. You should deploy robust antivirus and anti-malware tools across all endpoints. These help you detect and isolate threats before they can spread.

Do not neglect training and awareness. Human error can undermine the best technical defenses. Regular training sessions on phishing attacks, secure password practices, and recognizing social engineering tactics are essential. Add phishing simulations to your training curriculum. As well as being valuable learning experiences, they can also make your team more vigilant.

Finally, look at your incident response plan. You need a clear, well-documented plan that's practiced regularly. This should include steps for communication, containment, eradication, and recovery. This is the fire drill for cyber threats.

Each of these steps makes your company network more resilient against potential threats. Overall, threat modeling equips you with tools and awareness you need to protect your valuable data and systems. It’s a proactive approach for strengthening your overall cybersecurity posture, making it harder for attackers to succeed.