Threat Modelling in Brief

Threat modelling is applied in order to try to find threats to the company, for example, internal and external threats, threats related to the technology and infrastructure, cooperation partners, as well as the personnel. A special area within threat modelling is management of threats related to development projects. Threat modelling can convert theoretical anxiety into practical concrete issues (often even into commonplace matters) that are easy to approach. When the company can and dares approach an issue, it can be resolved.

What Mint Security Delivers

Mint Security does threat modelling in many ways. Threat modelling can be part of the development of administrative processes, the updating of risk registers, the security of application development processes – or it can be a one-time exercise only in order to assess the situation.

After our delivery, the customer has a comprehensive picture of the threats, a better ability to act independently in their threat environment – including the right tools.

Customer Needs and Challenges to Be Solved

By default, the threat model covers the entire company and its critical operations. We will, if necessary, engage the entire organization in the work. We strive to create an ability for the customers to utilize threat modelling so that the threat models are continuously updated and the benefits maximized.

New agile operating models, especially in application development, have partially ignored traditional risk management, focusing more on threat modelling. Threat modelling supports audits, code checking, and penetration test design.
Many standards and best practices, such as the Vahti instructions by the Finnish Government, recommend and even require that, for example, threat modelling is included in projects.

More Details about Our Methods and Tools

In threat modelling we strive to challenge current models of thinking about the state of the company and its security. Through the scenarios, we are able to engage both the management, business operations as well as the workforce. The scenarios are built in such a way that everyone can contribute and produce added value in the threat modelling. Due to the approach, the work is partly done in the form of workshops. We can base our work on different models, the most popular are DREAD and STRIDE.

In fact, there is no need for special tools in threat modelling, but in the threat modelling of technical architecture and application development we use modelling tools as well as the card game approach that is familiar from agile application development projects. For this, we use the Elevation of Privilege card game developed by Microsoft. As part of the threat modelling of application development, we also conduct an abuse case analysis (use case vs. abuse case).

Once the threat modelling workshops have been held, we will also make the necessary risk registry updates. Threat modelling may reveal new risks but also bring updates – realism – to current risks that have already been identified.
In process development, we also produce for our customers process descriptions related to the threat modelling and we attach the threat modelling to the current processes. As part of this work, we define the expectations of the threat modelling; what is demanded from it, what it wants to achieve and how this is measured.