To sum up the methodology of ethical hacking, what you do is :

  • Information gathering (gets the IP, domains, etc...)
  • Fingerprint the IP (what OS, what services are running, etc...)
  • Vulnerability assessment (are any services or vulnerable application found to be vulnerable ?)
  • Exploitation : verify the result of the step above

But, I came to realize during my security audit that end up either asking google questions like "what should I do to hack system A ?" or questions like "what are the tools to assess the security of system A ?"

It's like looking for a looking for a needle in a haystack.

Then I read a paper in which the audit started with threat modelling. I was just asking myself how would a hacker (either a script kiddy or an ethical hacker) should perform threat modelling in order to have results meaningful to integrate and follow the methodology (info gathering, fingerprinting, vuln assessement, etc...)

I'm starting to believe this would make the security audit more professional and its results more reproducible. What do you think ?

1 Answer 1


You are exactly right about the need for realistic threat modeling before conducting any type of security audit. If you don't understand or realize the threat actors (e.g: cybercriminal , disgruntled inside actor), it will be very difficult to know

  • What security controls to audit

  • How to interpret the results of your security audit as the severity of any vulnerabilities / findings must be put into the context of who / what is likely to defeat / bypass your security controls

What security controls to audit

Depending on the threat actors you believe are most likely to attack the assets your are trying to protect with security controls, the criticality of each security control to be audited differs. As an example, security controls that guard against attacks from threat actors looking to attack a web application may not be as applicable (if at all) when your most likely threat are in the physical environment - e.g: tailgating of individuals through electronic doors.

How to interpret the results of your security audit such as vulnerabilities detected

If you don't have a realistic and clear idea of who the threat actors are and the attack vectors they are most likely to use to exploit vulnerabilities detected, it is difficult to evaluate the likelihood and impact of the vulnerabilities noted. Likelihood and impact assuming exploitation are 2 key dimensions when ranking the severity of vulnerabilities, which in turn should influence how you prioritize the remediation of such vulnerabilities.

  • Thank you for your answer. Then again raise the question, how to conduct a proper threat modelling. Everything is so much oriented toward web app. And everything is so much theoretical that it makes it difficult to conduct for me with my little experience a proper threat modelling. Let's say I ought to audit a docker environment. I wont use STRIDE but the only thing I found interresting is digital ocean tutorial about docker CIS benchmak. Pretty frustrating
    – botanga
    Apr 29, 2020 at 7:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.