Page 37 - Risk Management Bulletin April-June 2022

RMAI BULLETIN APRIL - JUNE 2022

regularly. The threat modeling landscape is too complex the requirement and the corresponding mitigation. In
with old assumptions being regularly challenged. this way, by reporting all mitigations that are still open,
the security posture across a software portfolio is
A good example of this is the gradual decline of implied immediately realized and benchmarked against a given
trust and the rise of zero trust. With so many mitigations threshold. This information is useful to business
to consider and only one vulnerability being sufficient stakeholders in making decisions around risk mitigation.
for an attacker to exploit, we have great asymmetry.
This asymmetric nature of security implies a need for a Growing A Knowledge Base
more efficient way to understand the risk in a complex Over time, a repeating set of threats and remediation
technology landscape. The way to manage complexity
patterns will begin to emerge. Capturing this type of
is to diversify our security perspectives. This is in line
recurring information in a knowledge base and
with thinking about threats from an attacker's propagating it across similar architectures can save time
perspective; they work from several different
and allow us to scale our threat modeling. For example,
perspectives (as witnessed through advanced persistent
teams no longer need to spend time conducting threat
threats). Cross-functional teams help by reducing threat
modeling for similar types of applications only to
modeling bias based on personal preference or
recommend similar mitigations. The knowledge base
experience. The different perspectives provide
can also ingest additional information from the efforts
opportunities to consider additional attack patterns.
of other organizations like NIST and MITRE. In this way,
the value of the knowledge base increases as it
Increasing The Level Of Automation accumulates knowledge from a wider set of
When we describe automation, we generally try to vulnerability and remediation data.
remove as much human intervention as possible. This
improves consistency and increases speed. Threat Modeling Is Now A Critical
Unfortunately, as of today, we don't have fully
automated threat modeling. There is work being done Business Capability
to bring the benefits of AI into threat modeling. As of Threat modeling has now become a critical capability
now, however, we still need a consistent way to rapidly for business leaders. It helps to identify areas of security
translate recommended mitigations from threat risk, a board-level imperative. Not only that, but it also
modeling into actionable stories that have clear exit provides the steps required to mitigate the threat. This
criteria-something developers can execute against. provides a basis for cost/benefit analysis. Areas of
software security risk must be analyzed and remediated
The answer to this lies in creating a map between without sacrificing speed and agility. To a business
vulnerability mitigations and software code (which does stakeholder, having this type of information available
not preclude configuration files and other "as code" in a timely manner can make a huge difference in
artifacts). Using such a map, a test is triggered to verify managing operational risk and value delivery.

35