Where can I find a collection of Threat Models?

Question

I found a very nice SSL Threat model on this web page and would like to find more on different topics.

How would I go about locating more images like these? Is there an organisation or website I could go to?

Answer 1

SANS.org have a few really good resources. Including:

• http://www.sans.org/windows-security/2009/07/11/practical-risk-analysis-spreadsheet/
• http://software-security.sans.org/resources/paper/reading-room/threat-modeling-process-ensure-application-security
• http://www.sans.org/reading_room/whitepapers/securecode/threat-modeling-process-ensure-application-security_1646

Also for web application try https://www.owasp.org/index.php/Threat_Risk_Modeling.

Answer 2

If you like to get into the basics of Threat Models, then Threat Modelling from Microsoft Press is a nice book. Don't be put off by the introduction-page, it is an overall fine beginner read.

Answer 3

MyAppSecurity's ThreatModeler uses a software centric approach to Threat Modeling. It includes a feature to view an Attack Graph / Threat Pattern for individual software components.

ThreatModeler Page