Putting Threat Modeling Into Practice: A Guide for Business Leaders

Written by Scott Wheeler, Cloud Practice Lead at Asperitas, and Jason Nelson, founder of Necessary Security

Recognizing the value of threat modeling, a process that helps identify potential risks and threats to a business's applications, systems, and other resources, is easy enough. By providing comprehensive insight into how cyberattacks might be planned out before they occur, threat modeling helps organizations prepare proactively and reduce the risk of experiencing a successful breach.

What tends to be much harder is actually building effective threat models. Even in organizations with extensive cybersecurity resources, investment in threat modeling tends to be limited. Usually, this happens not because business leaders don't see the point of threat modeling but because closing the gap between goals and reality can prove deeply challenging when it comes to complex tasks like modeling threats.

But that doesn't mean organizations have to settle for limited insight into the threats and risks they face. On the contrary, by pushing past the hurdles that can make threat modeling challenging, business leaders can take full advantage of threat models to give their organizations a leg up in the battle against cyberattacks.

Here are tips on how executives can enable successful threat modeling initiatives.

Related:Master AI Cybersecurity: Protect and Enhance Your Network

The Importance of Threat Modeling for Compliance and Beyond

In some cases, businesses associate threat modeling with compliance. This is unsurprising because some regulators – including NIST (U.S.), ECB (EU), FCA (UK), APRA (Australia), and MAS (Singapore) – mandate threat identification and modeling as part of their cybersecurity frameworks. Threat modeling requirements are particularly stringent in the financial sector, where compliance is non-negotiable. Approving a threat modeling program will ensure adherence to these regulations, reduce security risks, and protect the company from potential fines and reputational damage.

That said, the value of threat modeling extends far beyond meeting compliance mandates. As senior manager of an engineering team, I've seen firsthand how integrating threat modeling into the software development process can significantly impact the business through benefits like faster time to market, reduced defects that make it to production, and long-term efficiency enhancements.

Improving time to market

Threat modeling enables organizations to identify potential security issues early in the development lifecycle, allowing the team to address these concerns before they escalate into costly problems. By proactively mitigating risks, companies can avoid the delays often caused by last-minute security fixes or post-deployment vulnerabilities. This streamlined approach accelerates our development process, allowing us to deliver secure, high-quality products to market faster.

Related:History of Cybersecurity: Key Changes Since the 1990s and Lessons for Today

Reducing defects in production

One of the primary benefits of threat modeling is its ability to reduce the number of defects that make it to production. By identifying potential threats and vulnerabilities during the design phase, companies can implement security measures that prevent these issues from ever reaching the production environment. This proactive approach not only improves the quality of products but also reduces the costs associated with post-production fixes and patches.

Creating reusable artifacts and reference patterns

Threat modeling helps us create reusable artifacts and reference patterns as code, which can serve as blueprints for future projects. These patterns encapsulate best practices and lessons learned, ensuring that security considerations are consistently applied across all projects. By embedding these reference patterns into development processes, organizations reduce the need to reinvent the wheel for each new product, saving time and resources.

Related:LLM Security: Going Beyond Firewalls

Reducing errors through established patterns

The existence of well-defined reference patterns reduces the likelihood of errors during development. Developers can rely on these patterns as a guide, ensuring they follow proven security practices and don’t have to start from scratch. This consistency not only improves the quality of code but also fosters a culture of security awareness across the team.

Supporting AI/ML with patterns as code

As organizations continue to integrate AI and machine learning (ML) into their development processes, patterns as code become even more valuable. These patterns provide a structured framework that AI/ML algorithms can leverage to automate threat detection and risk assessment. By feeding AI/ML models with established patterns, companies enhance their ability to identify potential security issues, reducing the need for manual intervention and accelerating the development process.

AI/ML-powered reductions in resource requirements

Integrating AI/ML into threat modeling and development processes can drive significant resource savings. By automating routine tasks such as threat detection, risk assessment, and even code review, AI/ML allows teams to focus on higher-value activities. This not only improves efficiency but also reduces the overall resources required to deliver secure, high-quality products to market.

Best Practices for Putting Threat Modeling Into Practice

To leverage these benefits in their organizations, business leaders must have an actionable plan to gain buy-in for threat modeling initiatives and make threat modeling a routine part of the software development process. The following practices can help.

Emphasize compliance mandates

Most compliance frameworks don't explicitly require the creation of threat models. However, threat modeling can help to meet compliance requirements, especially when dealing with frameworks that obligate businesses to assess risk systematically.

By emphasizing the role of threat modeling in meeting compliance obligations, business leaders can help push colleagues and employees to think about threat modeling not as a nice-to-have practice but as an essential requirement and a core component of their GRC strategies.

Highlight contractual obligations

Along similar lines, threat modeling can help meet obligations defined in contracts if those contracts include terms related to risk identification and management.

For example, if your company makes its software available to customers or partners, contractual commitments may require the business to mitigate risks within the software. These commitments prevent risks from flowing "downstream" into users' organizations. Having a threat model for the software helps to show that you're systematically managing risks.

Lean into IT security policies

Beyond obligations linked to compliance and contracts, many businesses also establish internal IT security goals. For example, they might seek to configure access controls based on the principle of least privilege or enforce zero-trust policies on their networks.

Threat modeling can help to put these policies into practice by allowing organizations to identify where their risks actually lie. From this perspective, threat modeling is a practice that the IT organization can embrace because it helps achieve larger goals – namely, those related to internal governance and security strategy.

Leverage chargebacks

Finding the budget to fund threat modeling can be challenging, especially because, again, the cost involves more than just purchasing a tool. Organizations must also account for the staff time that goes into creating and maintaining threat models.

Chargebacks can help. Using chargebacks, business leaders can effectively give contributors "credit" for helping with threat modeling initiatives. It incentivizes departments from across the organization to contribute to threat modeling, even if it's not formally part of their jobs. It also helps provide visibility into the cost of threat modeling and makes it easier to budget adequately for threat modeling initiatives.

Conclusion: Making Threat Modeling More Than a Buzzword

Threat modeling has become an indispensable tool for businesses – and not only because of its role in meeting certain compliance requirements. By creating reusable artifacts and reference patterns, reducing errors, and leveraging AI/ML, engineering teams can optimize their development processes and reduce the resources necessary to achieve their goals. This will become all the more true as teams continue to innovate and expand their use of AI/ML, in which context threat modeling will remain a cornerstone of ensuring that security is built into everything businesses do.

About the Authors

Scott Wheeler is Cloud Practice Lead at Asperitas, and Jason Nelson is the founder of Necessary Security.