Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I am doing research in the security of cloud computing.
The purpose of the following questions is to understand the relationship between "risk analysis" and "threat modeling":
Both terms are very slippery.
There are multiple risk analysis methodologies and they use different vocabulary and different assumptions. FAIR and the tire swing analogy are a good introduction, and if you can find Tony Cox's video, that is another good source. NIST 800-37 is an alternative methodology. OWASP has another.
Threat modelling is going through a renaissance - I did a google search and turned up the OWASP link that @Limit provided (and Limit deserves the credit because that is your best, first source) and a half dozen others. But there are NIST threat models, and some really creative thinking about a hierarchy of indicators of compromise. (You'll have to search the blogosphere - Bloor, OpenIOC, Chuvakin - I can't find the one I want that clearly shows a hierarchy diagram). The summary here is that we are at a tipping point - we now can collect enough data and do enough analysis to leverage threat intelligence to produce real gains in security. A decade ago, threat modelling was mostly theoretical and didn't have as strong an impact.
Personally I do risk assessment & analysis first, but I have to do a preliminary threat model during the risk analysis. My tech lead does the opposite, but he has years of doing advanced threat modelling.
I can't give you an example of a threat model - threat models are expensive to produce and we don't give those away. But if you know that 30% of the malware coming into your network use one malware toolset, you can configure your defenses to take advantage of that. Or if you know that across all the different malware campaigns, 70% of them attempt exfiltration as the payload/mission, then that will influence how you invest and configure your defenses. Threat models tell you what your adversary wants; if you know what the adversary wants, you have the opportunity to more effectively deny the adversary.
When I think about threat modeling, I think about 4 questions: what are you building/deploying; what can go wrong; what are you going to do about it; did you do a good job?
To me, risk analysis is often a useful extension of #3: what are you going to do about it, and how likely are those things to go wrong? (You can also see risk analysis as a way to think about overall risks, but I think that's pretty vague.)
So to your questions: No. What risks are you analyzing if you try to do risk analysis before threat modeling?
2: There are not a lot of good examples on the internet, but there are several in my book (Threat Modeling: Designing for Security). Various preview sites like Google Books or Amazon may or may not give you sufficient access to Appendix E to meet your needs.
