Abstract:Threat modeling involves systematically assessing the likelihood and potential impact of diverse security threat scenarios. Existing threat modeling approaches and tools act at the level of a software architecture or design (e.g., a data flow diagram), at the level of abstract system elements. These approaches, however, do not allow more in-depth analysis that takes into account concrete instances and configurations of these elements. This lack of expressiveness—as threats that require articulation at the level of instances cannot be expressed nor managed properly—hinders systematic risk calculation—as risks cannot be expressed and estimated in terms of instance-level properties. In this paper, we present a novel threat modeling approach that supports modeling complex systems at two distinct levels: (i) the design model defines the classes and entity types in the system, and (ii) the instance model specifies concrete instances and their properties. This innovation allows systematically calculating broader risk estimates at the design level, yet also performing more refined analysis in terms of more precise risk values at the instance level. Moreover, the ability to assess instance-level risks serves as an enabler for run-time continuous threat and risk (re-)assessment, and risk-adaptive security in general. We evaluate this approach in a prototype and through simulation of the dynamics of a realistic IoT-based system, a smart traffic application that involves vehicles and other infrastructural elements such as smart traffic lights. In these efforts, we demonstrate the practical feasibility of the approach, and we quantify the performance cost of maintaining a threat model at run-time, taking into account the time to perform risk assessment.

Threats Management Throughout the Software Service Life-Cycle

Building Security Awareness of Interdependent Services, Business Processes, and Systems in Cyberspace

Run-time threat models for systematic and continuous risk assessment

A Threat Model Driven Approach for Security Testing

ACTISM: Threat-informed Dynamic Security Modelling for Automotive Systems

Threat models over space and time: A case study of end‐to‐end‐encrypted messaging applications

Security Attack Behavioural Pattern Analysis for Critical Service Providers

Enabling Multi-Layer Threat Analysis in Dynamic Cloud Environments

RESOLUTION OF SAFETY RELEVANT SECURITY THREATS IN THE SYSTEM ARCHITECTURE DESIGN PHASE ON THE EXAMPLE OF AUTOMOTIVE INDUSTRY

QuantTM: Business-Centric Threat Quantification for Risk Management and Cyber Resilience

Development of a threat modelling framework and a web-based threat modelling tool for micro businesses

Model-Based Safety and Security Engineering

Sustainable Adaptive Security

PALANTIR: An NFV-Based Security-as-a-Service Approach for Automating Threat Mitigation

Cyber security threat modeling based on the MITRE Enterprise ATT&CK Matrix

Design, Implementation, and Automation of a Risk Management Approach for Man-at-the-End Software Protection

Automated Security Analysis for Microservice Architecture.

Moving Target Defense for Service-oriented Mission-critical Networks

Combining Cyber Security Intelligence to Refine Automotive Cyber Threats

A Novel Threat and Risk Assessment Mechanism for Security Controls in Service Management

Building a Cybersecurity Risk Metamodel for Improved Method and Tool Integration