Indonesia's Mount Lewotobi Laki Laki volcano erupts, sending ash cloud 18 km in the air
https://apnews.com/article/mount-lewotobi-laki-laki-volcano-eruption-e2b79474c192ee1ba8290946a28e4a54?utm_source=flipboard&utm_medium=activitypub
Posted into International News @international-news-AssociatedPress
🦄 Vlt (Cédric Hebert) 🇫🇷
in reply to Aaron • • •At its core, Threat Modeling is really "people talking about security".
"Tools" I use for threat modeling :
- A tool for drawing architecture diagrams such as Pencil or Draw.io
- Writing "STRIDE" on a whiteboard along with the definition of each letter
- A tool for taking notes such as Notepad
- The rest is about leading / moderating the discussion
More dedicated tools (AI-based ones included) are to me just adding complexity, confusion and/or give a false sense of security. Your mileage may vary.
Aaron
in reply to 🦄 Vlt (Cédric Hebert) 🇫🇷 • • •@vlt This isn't really useful, as folks that are not accustomed to thinking about security might not know all the ways in which they are vulnerable to what, and I'm not going to know that either, if it's a heterogeneous group. And I asked this specifically because the paranoia does make things go sideways in "people talking about security" situations
So I'm still looking for something to help ground people's thinking at the start of this type of conversation.
Aaron
in reply to Aaron • • •🦄 Vlt (Cédric Hebert) 🇫🇷
in reply to Aaron • • •you have to start somewhere 🤷
For total beginners I introduce TM by talking about passwords. I have a public video but it's in French.
I introduce risks from "high risk" to "low risk" and talk about mitigations. The real message behind is that you have to think about "what do I want to protect against" first and foremost, and thus that you might consider "low risk" something I consider "high risks" and vice versa.
To illustrate :
- high risk :
- password reuse
- brute force
- medium risk :
- phishing
- low risk :
- breach of online password manager
Now if your abusing partner has physical access to your phone, this changes everything. "What do I want to protect against" is the key question here to get started.
sleepfreeparent
in reply to Aaron • • •threat modeling tools seem focused on building ever more complicated taxonomies and that's a waste of time and attention. A simple risk register on paper or in a spreadsheet is much better than a fancy tool. Build up a list, using a formula like this, just fill in the ones you know and figure out the others later:
ACTOR-TYPE is HOW-LIKELY to do ACTION to SUBJECT because MOTIVATION, and this would cause IMPACT to me, so I'd better do MITIGATIONS to bring about OUTCOMES.
Any time you have an "oh shit!" realization, add it to the risk register filling in what you know so far. Every so often, meet with others and compare your assessment to theirs. Rank risks by HOW-LIKELY * IMPACT and then see what MITIGATIONS you can think of, you're looking for OUTCOMES that either reduce MOTIVATION or IMPACT, or at least give you some detection of ACTION.
I use ACTOR-TYPE because you can somewhat predict the MOTIVATION of e.g. corporations or abusers or ransomware groups, and many risks are reusable between models when done this way, but feel free to name specific actors if it makes sense for a given risk.
I include SUBJECT because you can still be hit by the IMPACT when you're not the direct target of an ACTION, and it gets you thinking about what vulnerable components you may have and how all the parts talk to each other and the outside world.
You can start with the risk register, or with a system decomposition, whichever makes it easier, but the goal is getting used to enumerating and dissecting risks, writing them down and sharing them with peers.
Aaron
in reply to sleepfreeparent • • •