Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

There are at least three different common approaches to creating a threat model:

  • Attacker-centric
  • Software-centric
  • Asset-centric

You can take a look at Wikipedia for a quick overview.

I wonder if one of those approaches has proven to be superior in general or if you have to choose them depending on the situation at hand. I have experience with all three of them and I personally prefer the attacker-centric approach because it feels straight forward and it fits my way of thinking. I can see the benefits of the asset-centric approach, especially if you want to see the business impact of certain threats directly. The software-centric approach feels clumsy and heavy-weight to me. If you want to drill in really deep and have a lot of time at hand for threat modeling it might be a good option though.

These are just my personal experiences. Is there an approach that has has proven to be superior in general or do you have to choose them depending on the situation at hand? Is there a common understanding about that in the Security Community.

share|improve this question
add comment

2 Answers

up vote 1 down vote accepted

Does Threat Modeling have to be confined to one of those approaches? A hybrid approach might be better suited to meeting your security goals.

On the one hand you can measure the risk to your assets and in combination with a software centric approach, get your development teams to follow development best practices.

share|improve this answer
    
On a side note, what do you see as challenges to traditional threat modeling approaches? Any testimonials with measurable results to a specific approach or methodology? –  Epoch Win Jan 30 '12 at 21:11
add comment

I prefer asset-centric approach. It works best for me, it usually easy to identify system assets and then to do threat analysis for each asset.

But whatever works for you (and your manager)

Regards

Aaron

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.