Do you Practice Threat Modeling?

New threats require new defenses – which is the main reason why cybersecurity is never completed. Constantly evolving security measures are the price of protecting your business.

You must continue to take proactive steps as cyber threats continue to increase. Protecting your sensitive data and assets from cybercriminals is a constant, ongoing task. Threat tactics change as cyber-defenses improve, since danger to data security is persistent and attacks come from many different places.

Consider how much more digitally sophisticated our offices are these days, compared to 10 years ago. Just about every activity relies on some type of technology and data sharing. Cybercriminals can breach these systems from several entry points. The list of vulnerable devices includes computers, smartphones, cloud applications, network infrastructure, and peripherals, like IoT (Internet of Things) devices.

According to estimates, cybercriminals can penetrate an astounding 93%  of company networks.

One comprehensive approach to help your organization fight these intrusions is threat modelling. It involves identifying potential threats and vulnerabilities to an organization's assets and systems by prioritizing risk management and mitigation strategies.

It’s not a matter of IF, but of WHEN an attack is going to happen, and some will be successful – primarily due to untrained or unaware employees falling for phishing schemes. Once the fox is in the henhouse, what do you do? Threat modelling helps keep the henhouse door closed, mitigating the risk of falling victim to a costly cyber incident.

To conduct a threat model, follow these steps:

1: Identify Assets Needing Protection

Identifying assets that are most critical to the business is a common sense first step. These assets include sensitive data, intellectual property, and financial information among other things. Cybercriminals could be going after any of these.

Assets like company email accounts need to be included because hackers use these for phishing attacks. Business email compromise (BEC) is a fast-growing method of attack which capitalizes on breached company email logins.

2: Find and Identify All Potential Threats

Establishing what the potential threats are to these assets is the next step. These threats do tend to fall into ‘The Usual Suspects’ category. Some common threats could be cyber-attacks such as phishing. Others would be ransomware, malware, or social engineering.

Physical breaches or insider threats another category to consider. This is where employees or vendors have access to sensitive information.

Threats aren’t always purposefully malicious. Human error causes approximately 88% of data breaches. So, ensure you’re aware of mistake-related threats, such as:

Using weak passwords

Unclear cloud use policies

Lack of employee Security Awareness Training

Poor or non-existent BYOD (Bring Your Own Device) policies

3: Assess Likelihood and Impact

You need to rank your risk management and mitigation strategies according to the likelihood and impact of the threats you have identified. Businesses must understand how likely each threat is to occur as well as the potential impact on their operations, reputation, and financial stability.

Consider the budget of the County of Los Angeles: should we allocate more funds for fire prevention and firefighting – or a tornado warning system? It’s not that tornadoes never happen, it’s a matter of prioritizing according to frequency.

The wise approach is to base the likelihood of cyber-threats we face on current statistics as well as a thorough a vulnerability assessment. It's best that this assessment is performed by a trusted 3rd party IT provider. If you’re doing your assessment with only internal input, or by your regular IT people, you’re bound to miss something. Also, it’s human nature for people to hide mistakes and sloppy work.

Here at ITFIRM.COM, we offer a FREE non-intrusive scan and report of the state of your network and security. Details are at the bottom of this page. We have performed these assessments many, many times, and it is extremely rare that we don’t find security problems.

4: Prioritize Your Strategies for Risk Management

Prioritizing your risk management strategies should be based on the likelihood and impact of each potential threat. Most businesses can’t tackle everything at once due to time and cost constraints. So, it’s important to rank solutions based on the biggest impact on security.

Here are a few of the most common strategies to consider implementing:

Access controls

Firewalls

Intrusion detection systems

Employee training and awareness programs

Endpoint device management

Businesses must also determine which strategies are most cost-effective. They should also align with their business goals.

5: Review and Update the Model Continuously

Just like network security, threat modelling is not a ‘one and done’ process. Cyber threats are constantly evolving, so your defenses need to stay a step ahead. Continuously review and update your threat models. This will help ensure that security measures are not only effective but aligned with your business objectives.

What is a benefit of threat modeling?

Threat modelling provides a good number of benefits:

Enhances Knowledge of Threats and Vulnerabilities

The regular practice of threat modelling can help you gain a better understanding of specific threats. It also uncovers vulnerabilities that could impact your assets by identifying gaps in your security measures and helps uncover risk management strategies.

Performing threat modelling on an ongoing basis can also help companies stay out in front of new threats. Artificial Intelligence (AI) is birthing new types of cyber threats every day. Companies that are complacent can fall victim to new attacks.

Risk Management Cost-effectiveness

Once you give threats and the corresponding strategies to mitigate them a ‘pecking order,’ you can optimize your company resources and security investments. This will help ensure that you can divide resources effectively and efficiently.

Improved Business Alignment

You ensure that security measures align with the business objectives through regular threat modelling. This can reduce the potential impact of security measures on business operations. It also helps coordinate security, goals, and operations.

Reduces the Risk of Cyber Incidents

That’s the crux of threat modelling - implementing targeted risk management strategies reduces risks – specifically the likelihood and impact of security incidents. This will help to protect your assets and reduce the negative consequences of a security breach.