Developer-Driven Threat Modeling: Lessons Learned in the Trenches

This article describes EMC/s real-world experiences with threat modeling, including major challenges encountered, lessons learned, and a description of the company's current developer-driven approach. Threat modeling is a conceptual exercise in which we analyze a system's architecture or design to find security flaws and reduce architectural risk.

A Developer-Driven Threat-Modeling Process

In 2007, EMC began efforts to roll out threat modeling as an integral part of its secure software development processes. The intent was to address security better and embed security considerations into software design processes and throughout the corporation's culture. The threat-modeling process at EMC has evolved over the past few years and currently involves •

creating an annotated dataflow diagram;

•

identifying and analyzing threats, guided by a threat library;

•

assessing threats' technical risk; and

•

mitigating threats to reduce risk.