Topics in this domain
- Risk Management Concepts and Frameworks
- Inherent Risk, Residual Risk, Appetite and Tolerance
- Threat Actors, Motivations and Attack Vectors
- The Evolving Threat Landscape: AI, Cloud and Supply Chain
- Threat Modelling and Cyber Threat Intelligence
- Vulnerability Assessment and Scanning
- Control Deficiencies and Security Gap Analysis
- The Risk Assessment Process
- Qualitative Risk Analysis: Likelihood and Impact
- Quantitative Risk Analysis: SLE, ALE and Loss Estimation
- Risk Scenarios and Prioritisation
- Risk Treatment Options: Mitigate, Transfer, Avoid, Accept
- Risk Acceptance: Approval, Expiry and Review
- Cost-Benefit Analysis for Risk Treatment
- Risk Ownership vs Control Ownership
- RACI and Risk Escalation Paths
- The Risk Register
- Continuous Risk Monitoring and Key Risk Indicators
- Risk Reporting to Executives and the Board
- Integrating Risk Management into Business and IT Processes
Threat Modelling and Cyber Threat Intelligence
Two views of threats
| Threat modelling | Cyber threat intelligence | |
|---|---|---|
| Direction | Inside-out | Outside-in |
| Question | How could this system be attacked? | What are attackers actually doing, to whom, and how? |
| When | During design and major change | Continuously |
| Feeds | Design decisions and controls | Risk assessment, controls, detection, executive decisions |
Threat modelling with STRIDE
STRIDE, developed at Microsoft, groups threats into six types, each violating a security property:
| Threat | Violates | Example control |
|---|---|---|
| Spoofing | Authentication | MFA, certificates |
| Tampering | Integrity | Hashing, signing, access control |
| Repudiation | Non-repudiation | Logging, digital signatures |
| Information disclosure | Confidentiality | Encryption, least privilege |
| Denial of service | Availability | Rate limiting, redundancy |
| Elevation of privilege | Authorisation | Least privilege, input validation |
Other methods include attack trees (the attacker’s goal at the root, ways to achieve it as branches) and PASTA (a risk-centric, seven-stage process). The method matters less than doing it systematically.
When and how
- During the design of new systems and major changes, when fixing is cheapest.
- Draw the system: components, data flows and trust boundaries.
- Walk each element through STRIDE.
- Rate the threats, design controls and record the decisions.
Example. Modelling a new customer portal shows the password-reset flow could be abused to take over accounts (spoofing). Adding verification to the design costs a day. Fixing it after launch would have needed an emergency release and a fraud investigation.
Cyber threat intelligence
Cyber threat intelligence (CTI) is evidence-based knowledge about threats, analysed so that it supports decisions.
| Level | Content | Audience |
|---|---|---|
| Strategic | Trends, actors, motives, geopolitics | Executives, board: where to invest |
| Operational | Campaigns currently targeting the sector | Security managers |
| Tactical | Attacker tactics, techniques and procedures (TTPs) | Defenders, architects |
| Technical | Indicators of compromise: IP addresses, file hashes, domains | The SOC and its tools |
Sources include commercial feeds, sector ISACs, government agencies, open-source intelligence (OSINT) and the organisation’s own incidents.
The intelligence cycle
- Direction: what do we need to know?
- Collection from relevant sources.
- Processing: filter and normalise.
- Analysis: what does it mean for us?
- Dissemination to the right audience, in the right form.
- Feedback: was it useful?
Raw feeds aren’t intelligence until they’ve been analysed for relevance. And intelligence nobody acts on has no value.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| Best time to do threat modelling | During design |
| Threat category that violates integrity | Tampering |
| Intelligence aimed at the board | Strategic |
| IP addresses and file hashes | Technical intelligence (indicators of compromise) |
| Main value of threat intelligence | Better-informed risk and control decisions |
In short
- Threat modelling identifies how a system could be attacked, ideally during design, when fixing is cheapest.
- STRIDE groups threats into spoofing, tampering, repudiation, information disclosure, denial of service and elevation of privilege.
- Other methods include attack trees and PASTA; the method matters less than doing it systematically.
- Cyber threat intelligence (CTI) is evidence-based knowledge about threats, used to make decisions.
- CTI works at four levels (strategic, operational, tactical, technical) for different audiences.
- Intelligence is only valuable if it's relevant, timely and acted on; it feeds risk assessments, controls and detection.
Exam traps
- Threat modelling done after go-live misses the cheapest chance to fix design flaws.
- Raw threat feeds aren't intelligence until they're analysed for relevance.
- Strategic intelligence is for executives; technical indicators are for the SOC. Don't mix the audience.
- Intelligence that nobody acts on has no value.
Slides
Click the slide and use the arrow keys. F toggles full screen.
Threat modelling with STRIDE
Levels of intelligence