What could be the Relationship between threat analysis and attack modeling.
Both are pretty close, have different perspectives but I need to know the relationships or in other words, how can they got integrated in an organization.
Update: Here are the two definitions found on net:
Cyber threat analysis is a process in which the knowledge of internal and external information vulnerabilities pertinent to a particular organization is matched against real-world cyber attacks.
Analyzing the threat is the steps of
- defining the scope of threats/risks
- Collecting/gathering necessary information
- Analyzing the data (Threat/Vulnerability Analysis of Risks and determining the level of Risk)
- Action, Mitigation & Anticipation [Ref]
Attack Modeling "One of the points we need to make here is that when you try to model things from an adversarial viewpoint, you are Attack Modeling, not Threat Modeling. When you start with a vulnerability, and see what kind of damage you can do, you are modeling an attack. This is how traditional 'bug hunting' "threat modeling" operates. So technically, we haven't been threat modeling at all, we've been attack modeling.
Examples: THREAT: Getting our customer data exposed to unauthorised individuals. RISK: The likelihood of getting our customer data exposed is medium and if realised would result in a $5,000,000 financial loss in addition to loss of customer loyalty. ATTACK: Exploiting an SQL Injection vulnerability resulting in the bad guy being able to download the customer database. It is important to remember this distinction when you are performing your security evaluations, threat modelling, and penetration testing." Ref