Written by Sebastien Deleersnyder

OWASP SAMM Threat Modeling: From Good to Great

In today’s digital age, the reliance on digital services and products has significantly increased. However, this increased dependency also comes with the need for trust and security. As innovation accelerates and DevOps teams work at increasing speed, integrating security and privacy into products becomes more challenging. This is where threat modeling can play a crucial role. Threat modeling is the process of identifying and managing application risks, enabling security specialists to collaborate with product teams and help them make informed security design choices. In this blog post, we will explore how OWASP SAMM (Software Assurance Maturity Model) threat modeling can take security practices from “good” to “great” in implementing a robust Secure Development Lifecycle (SDL).

The Benefits of Threat Modeling

Threat modeling offers several advantages for organizations aiming to enhance their security posture:

Shared Vision: Threat modeling brings the product team and security subject matter experts together, fostering a shared understanding and vision of security objectives and the path to reach those objectives.
Flaw Prevention: By identifying security design flaws early in the development process, threat modeling helps prevent vulnerabilities from being introduced.
Risk Identification and Mitigation: Threat modeling enables the identification and addressing of the most critical risks, allowing development efforts to be prioritized based on risk weighting.
Documentation and Compliance: Threat modeling helps document due diligence, ensuring compliance with regulations such as GDPR or FDA requirements. It also helps to demonstrate to your customers that you are taking security by design seriously.

On 31 May, Sebastien presented this topic as part of the OWASP Germany Day. We will publish the recording soon.
You can already download the presentation here.

Challenges and Drawbacks

While threat modeling offers significant benefits, it is essential to acknowledge the challenges and potential drawbacks:

Expertise Requirements: Threat modeling often requires external security expertise, making it necessary to involve specialists in the process. It is recommended to have an expert threat modeler present during your first threat modeling workshops.
Time-Intensive: Performing thorough threat modeling can be time-consuming, adding to the development cycle and potentially increasing costs.
Scalability Issues: Internalizing and replicating threat modeling across an organization’s application portfolio can be challenging, especially without standardized processes and tools.
Limited Tool Functionality: Existing threat modeling tools may have limitations in functionality, potentially hindering the effectiveness of the process.

The Role of Threat Modeling in the Secure Development Lifecycle

It is important to note that threat modeling is not the sole security activity but rather an integral part of an SDL. OWASP SAMM provides a maturity model for threat modeling, outlining three levels of advancement:

Level 1: Perform best-effort, risk-based threat modeling using brainstorming and existing diagrams along with simple threat checklists.
Level 2: Standardize threat modeling training, processes, and tools to enable scalability throughout the organization.
Level 3: Continuously optimize and automate threat modeling methodologies to achieve repeatable and efficient practices.

Scaling Up Threat Modeling

To scale up threat modeling and make it more repeatable, organizations should focus on the following aspects:

Outcome Alignment: Align security controls with risk levels, attacker profiles, risk appetite, and required assurance levels. Increase awareness and align the vision for security and privacy across the organization and the involved product teams.
Measuring the success and Return on Investment (ROI) of threat modeling is crucial for organizations to understand the value it brings and justify the resources and efforts invested in the process. By effectively measuring the impact of threat modeling, organizations can demonstrate its effectiveness in improving security, reducing incidents, minimizing delays and rework, and enhancing overall assurance and trust levels.

Components of a Threat Modeling Program

To establish an effective threat modeling program, organizations should consider the following components:

Training: Provide training tailored to different roles and involvement in threat modeling activities. As a shameless plug, we recommend you have a look at our upcoming threat modeling training sessions.
Templates and Patterns: Create or improve threat modeling templates, application risk profiles, risk patterns based on technology stacks, and compliance and requirement patterns. Utilize organization-specific threat intelligence and knowledge bases to support this process.
SDL Integration: Strengthen the integration of threat modeling into the overall SDL. Define hooks for integrating threat modeling into product development and operational processes.
Governance and Strategy: Establish governance mechanisms, define strategy, set Key Performance Indicators (KPIs), and regularly monitor and report on threat modeling activities.
Community and Culture: Foster a collaborative and inclusive culture around threat modeling. Organize internal and external sessions with key stakeholders to share knowledge and experiences.
Tooling: Speed up threat modeling with tooling for teams to be able to remotely collaborate on shared threat models with automation to integrate with the developer toolses and application pipelines.

Getting Started with Threat Modeling

To initiate the threat modeling journey, organizations can follow the steps outlined in the OWASP SAMM maturity model:

Assess the Current Situation: Measure the organization’s initial threat modeling capabilities and identify areas for improvement.
Determine Target Situation: Define the desired maturity level based on application risk profiles, compliance requirements, and organizational risk appetite.
Create a Roadmap: Develop a roadmap based on the gap analysis between the current and target threat model practices. Prioritize actions and establish timelines for implementation.
Execute and Follow Up: Implement the roadmap, ensuring proper execution of threat modeling activities. Regularly monitor progress and adjust where necessary.
Measure and Demonstrate ROI: Make the output of threat modeling measurable to demonstrate Return on Investment (ROI). Track improvements in security (e.g. reduced attack surface) , reduced vulnerabilities, and increased efficiency (e.g. fewer delays before release).

Conclusion

Threat modeling is a crucial practice in enhancing the security and privacy of digital services and products. By adopting the OWASP SAMM maturity model, organizations can elevate their threat modeling practices from “good” to “great.” By aligning security objectives, measuring success, and implementing a comprehensive threat modeling program, organizations can effectively address security risks and build robust and resilient software. To embark on this journey, organizations are encouraged to download the OWASP SAMM playbook and leverage the guidance provided to implement threat modeling at scale.