Relationship-Based Threat Modeling

Abstract

Threat modeling is a common technique for the systematic analysis of system designs to uncover security and privacy threats. Popular threat modeling techniques, however, currently only consider a very localized system context, which hinders the discovery of more complex attack scenarios that involve multiple interactions throughout a system. This may lead to the underestimation of threats that are not harmful by themselves but enable multiple other high-risk threats. Furthermore, current risk assessment approaches require stakeholders to take the system as a whole into account when providing inputs, which is tedious and error-prone.

This paper introduces relationship-based threat modeling (RBTM). Using explicitly captured threat relationship knowledge, RBTM allows to systematically and automatically generate a threat graph which is then used as input for traceable risk calculations. This removes the need to manually take into account threat relationships during risk assessments and allows stakeholders to clearly identify and communicate the rationale behind the resulting risk values. The outputs of an RBTM analysis were compared to those of a manual one performed by experts to evaluate the soundness of our proposal, which also highlighted the traceability benefits.