1. Security Consulting and Strategic Research
Threat Modeling
Jeffrey A. Ingalsbe
Security Consulting and Strategic Research
Ford Motor Company
(313)

2. The Problem(s) Security was viewed as IT’s responsibility
Security was viewed as an add-on or a burden
Internal Business customers were adversarial
Internal Business customers were absent
Auditability of the sdlc was poor
The same vulnerabilities kept were not going away
There was no “dial” for controls
It was difficult to talk to lawyers about risk
The intranet was considered “safe”
Employees were “trusted”
NOTES: Refer to avoidance of re-work (last bullet) is applied at optimal point in development process. Contrast with penetration testing and security assessments (both occurring later in the process).

3. One Solution: Threat Modeling
Threat Modeling is :
A repeatable process
Collaborative
Proactive
Executed during the design phase (mostly)
Risk quantifying
Business empowering
Awareness raising
NOTES: Refer to avoidance of re-work (last bullet) is applied at optimal point in development process. Contrast with penetration testing and security assessments (both occurring later in the process).

4. Ford’s Journey Piloted Microsoft’s TAM tool in 2005
Rolled out Threat Modeling as a service in 2007
Launched “Fast Pass” Threat Modeling in 2008
Piloting Microsoft’s SDLTM tool in 2009
NOTES: Refer to avoidance of re-work (last bullet) is applied at optimal point in development process. Contrast with penetration testing and security assessments (both occurring later in the process).

5. Terms
Model: Representation of reality constructed using Roles, Data, and Components, used to build Use Cases, generate Threats, and analyze Risk, and develop a Risk response.
Use Case: Not a UML use case. A higher level interaction between people and the components of your system involving data to achieve some business objective.
Threat: Potential unintended event which may occur within a use case. There are three kinds of threats according to the Microsoft tools: threats to Confidentiality , threats to Integrity, and threats to Availability. NOTE: A threat doesn’t have to be malicious!
Risk: The aggregate of discoverability, reproducibility, exploitability, affected users, and damage potential (DREAD).
Risk Response: Planned action to address risk. You can Reduce, Transfer, Avoid, Accept.
NOTES: Refer to avoidance of re-work (last bullet) is applied at optimal point in development process. Contrast with penetration testing and security assessments (both occurring later in the process).

6. Participants Business owners First and foremost SMEs Architects
Developers
Application owners
Infrastructure owners
IT Security
Threat modelers
CIRT
Forensics
Encryption
Authentication
NOTES: Refer to avoidance of re-work (last bullet) is applied at optimal point in development process. Contrast with penetration testing and security assessments (both occurring later in the process).

7. Time Commitment Minimum Maximum 7 calendar days
3 half-day meetings with the entire team
2 full-days of work for security members
Maximum
4 to 6 calendar weeks
4 to 6 half day meetings with the entire team
1 or 2 full-days of work for security members
NOTES: Refer to avoidance of re-work (last bullet) is applied at optimal point in development process. Contrast with penetration testing and security assessments (both occurring later in the process).

8. Process Identify business objectives Set scope Construct model Roles
Data
Compnents
Use cases
Generate threats
Analyze threats
Determine Risk Responses
Report out
Improve process
NOTES: Refer to avoidance of re-work (last bullet) is applied at optimal point in development process. Contrast with penetration testing and security assessments (both occurring later in the process).

9. Process
NOTES: Refer to avoidance of re-work (last bullet) is applied at optimal point in development process. Contrast with penetration testing and security assessments (both occurring later in the process).

10. Results
Used threat modeling to reduce risk on strategically important IT projects.
Saved significant calendar time on processing launch related IT work.
Optimized process and applied to pilots, PoCs, and processes.
Raised awareness on risk-based decision making.
Taught people to fish.
Moved the needle with several important business customers (specifically the OGC).
NOTES: Refer to avoidance of re-work (last bullet) is applied at optimal point in development process. Contrast with penetration testing and security assessments (both occurring later in the process).

11. Security Consulting and Strategic Research
Questions
Jeffrey A. Ingalsbe
Security Consulting and Strategic Research
Ford Motor Company
(313)
NOTES: Refer to avoidance of re-work (last bullet) is applied at optimal point in development process. Contrast with penetration testing and security assessments (both occurring later in the process).