DevSecOps and the Evolution of Threat Modeling
August 15, 2022

Archie Agarwal

Threat modeling has become an integral part of the software development process, providing developers with an opportunity to identify security threats and vulnerabilities and create logical remediation methods.

While threat modeling appears straightforward in concept, it features many variations and nuances in practice. The diversity of threats and vulnerabilities requires developers to evolve threat modeling practices to the current security landscape.

The ability to adjust to different threat environments is core to the concept of threat modeling. The process focuses on protecting a system in a risk-based way instead of simply following a standard checklist. Let's look more at threat modeling, how the practice started and how it continues to flourish today.

The Origins of Threat Modeling

In the mid-1990s, Microsoft engineers Praerit Garg and Loren Kohnfelder developed STRIDE, a mnemonic device for security threats that is seen as the first threat modeling process. STRIDE (which stands for: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, and Elevation of privilege) works to remind developers of what threats a platform may face.

Since then the tools and models have improved and simplified threat modeling. Advancements in threat modeling include:

Data Flow Diagrams (DFD). These help visualize how data flows through a system, allowing developers to identify potential weak points in the security architecture.

OWASP PASTA. The Open Web Application Security Project's PASTA (process attack simulation and threat analysis) serves as a methodology that emphasizes identifying threat impacts earlier in the development process. It also recognizes that risks should be ranked based on their overall severity.

OWASP ASVA. ASVA (application security verification standard) is a checklist replacement for STRIDE. It goes beyond STRIDE and evolves to become more comprehensive.

Threat Modeling in Today's Environments

Today's threat modeling tools can automatically analyze infrastructure-as-code in a DevOps pipeline for threats and provide recommended remediation. As cyber-attacks continue to be on the rise, companies have begun to understand the importance of including security as part of their DevOps pipelines.

Too often, security was either left out of the development process or instituted later in later stages. The driving force was often speed, as DevOps environments pushed for quicker development times, leaving security as an afterthought.

Developers often lacked the proper skills to add security controls. Developer training has usually focused on application development and the ability to add functionality with security seen as a necessary — and often underdeveloped — evil that slowed execution.

With growing security threats, the practice of simply having security "bolted on" at the end does not work, especially in CI/CD pipelines. However, this can be challenging as security risks can arise during the integration stage until the DevOps model is fully implemented.

A Better Path Forward

Security practitioners continue to push security development left. The emergence of next-gen threat modeling and increased automated technologies during the development process will further add benefits.

When implemented correctly, threat modeling can create system-wide security improvements, knowledge sharing among teammates, proactive design guidance, and improved communication between stakeholders.

Threat modeling technologies continue to advance and move past the manual and outdated structures that developers long relied. Using automation, enhanced collaboration, and more robust libraries for threat model templates will improve the speed and scale of development.

As we continue forward, we will see a Github-ification of threat models. Developers will share threat models to improve overall development, allowing developers to create similar tools and the ability to communicate from a collective expertise.

Threat modeling has made tremendous strides in the past 25 years. As we move forward, continued advances will strengthen the process and bring a higher level of security to the DevOps process.

Archie Agarwal is Founder and CEO at ThreatModeler
Share this

Industry News

February 02, 2023

Red Hat announced a multi-stage alliance to offer customers a greater choice of operating systems to run on Oracle Cloud Infrastructure (OCI).

February 02, 2023

Snow Software announced a new global partner program designed to enable partners to support customers as they face complex market challenges around managing cost and mitigating risk, while delivering value more efficiently and effectively with Snow.

February 02, 2023

Contrast Security announced the launch of its new partner program, the Security Innovation Alliance (SIA), which is a global ecosystem of system integrators (SIs), cloud, channel and technology alliances.

February 01, 2023

Red Hat introduced new security and compliance capabilities for the Red Hat OpenShift enterprise Kubernetes platform.

February 01, 2023 formally launched with Devbox Cloud, a managed service offering for Devbox.

February 01, 2023

Jellyfish launched Life Cycle Explorer, a new solution that identifies bottlenecks in the life cycle of engineering work to help teams adapt workflow processes and more effectively deliver value to customers.

January 31, 2023

Ably announced the Ably Terraform provider.

January 31, 2023

Checkmarx announced the immediate availability of Supply Chain Threat Intelligence, which delivers detailed threat intelligence on hundreds of thousands of malicious packages, contributor reputation, malicious behavior and more.

January 31, 2023

Qualys announced its new GovCloud platform along with the achievement of FedRAMP Ready status at the High impact level, from the Federal Risk and Authorization Management Program (FedRAMP).

January 30, 2023

F5 announced the general availability of F5 NGINXaaS for Azure, an integrated solution co-developed by F5 and Microsoft that empowers enterprises to deliver secure, high-performance applications in the cloud.

January 30, 2023

Tenable announced Tenable Ventures, a corporate investment program.

January 26, 2023

Ubuntu Pro, Canonical’s comprehensive subscription for secure open source and compliance, is now generally available.

January 26, 2023

Mirantis, freeing developers to create their most valuable code, today announced that it has acquired the Santa Clara, California-based Shipa to add automated application discovery, operations, security, and observability to the Lens Kubernetes Platform.

January 25, 2023

SmartBear has integrated the powerful contract testing capabilities of PactFlow with SwaggerHub.

January 25, 2023

Venafi introduced TLS Protect for Kubernetes.