TryHackMe - What is a"Threat Modeling" (Unified Kill Chain) | SOC Analyst 1

on

Threat modelling, in a cybersecurity context, is a series of steps to ultimately improve the security of a system. Threat modelling is about identifying risk and essentially boils down to:

  1. Identifying what systems and applications need to be secured and what function they serve in the environment. For example, is the system critical to normal operations, and is a system holding sensitive information like payment info or addresses?
  2. Assessing what vulnerabilities and weaknesses these systems and applications may have and how they could be potentially exploited
  3. Creating a plan of action to secure these systems and applications from the vulnerabilities highlighted
  4. Putting in policies to prevent these vulnerabilities from occurring again where possible (for example, implementing a software development life cycle (SDLC) for an application or training employees on phishing awareness).


Threat modelling is an important procedure in reducing the risk within a system or application, as it creates a high-level overview of an organisation's IT assets (an asset in IT is a piece of software or hardware) and the procedures to resolve vulnerabilities.

The UKC can encourage threat modelling as the UKC framework helps identify potential attack surfaces and how these systems may be exploited.

STRIDE, DREAD and CVSS (to name a few) are all frameworks specifically used in threat modelling. If you are interested to learn more, check out the “Principles of Security” room on TryHackMe.

Answer the question below
What is the technical term for a piece of software or hardware in IT (Information Technology?)Asset

Comments

Post a Comment