Question

need at least 150 word count per question.

How can you include threat modeling within your SSDLC?

At what points of the lifecycle would you include threats?

Why would you do it then instead of another phase?

Answer 1

1. To identify threats ,we have to go through and understand threat model activities .Some threat model activities are as below,Defining the scope and depth of the analysis , Gaining an understanding of what you are threat modeling, Modelling the attack possibilities, Interpreting the threat model, Creating a traceability matrix to record missing or weak controls.
2. In SDLC threat modeling should be done once the architecture is in place for resolving the issues in SDLC the cost will be more for resolving the threat.
3. Its not mandatory that all applications undergo threat modeling.
4. No matter in which stage our application is ,whether it is in deployment stage or production stage we can still pick up the threat modeling.
5. Through threat modeling we can know the potential flaws in the system, that is why we can take a decision about investing further in that system.
6. There are some threat modeling methodologies , Assessment scope, Identity threat agents and possible attacks, Understanding existing counter measures, Identify exploitable vulnerabilities, prioritized identified risks, Identify counter measures to reduce threat.