The Advantages of Using a Threat Modeling Tool for STRIDE

The advantages of using a threat modeling tool for STRIDE consist of:

• Easier STRIDE threat modeling for the team.
• Less training and knowledge are required for the team because they’re following the steps outlined by the tool.
• Easier registration of STRIDE threat modeling results because the results are automatically stored in the tool.
• Better follow-up of countermeasures from STRIDE threats because the countermeasures are automatically stored in the tool.

Before I move on, what is STRIDE threat modeling: STRIDE is a type of threat modeling specifically aimed at defining potential threats that may impact an application, IT system, or business process. It was initially developed by engineers working at Microsoft. STRIDE threat modeling is a well-known process within the threat modeling community.

And what is a STRIDE threat modeling tool: A STRIDE threat modeling tool is a tool that allows you to easily create a threat model (in an application or tool environment). It should easily and clearly support the ideation and registration of STRIDE threats.

Using a Threat Modeling Tool for STRIDE Threat Modeling

The list below explains the advantages of using a threat modeling tool for STRIDE:

• Easier STRIDE threat modeling for the team: If you manually threat model (meaning not using a tool), you will need extensive knowledge of threat modeling and security concepts, and you will need a very descriptive procedure regarding the how of threat modeling. If you use a threat modeling tool, these process steps are provided and explained within the tool. By using a threat modeling tool you will be guided, making it easier for the team.
• Less training and knowledge are required for the team because they’re following the steps outlined by the tool: Training and explaining threat modeling to a development (or DevOps) team eats into valuable time. This is valuable time that could be used for other purposes such as developing more business-critical features. Providing a tool to a team is far easier than explaining the some what theoretical concepts of STRIDE threat modeling.
• Easier registration of STRIDE threat modeling results because the results are automatically stored in the tool: You don’t perform STRIDE threat modeling for the fun of it. It must provide results in the form of STRIDE threats. When performing manual threat modeling, it is difficult to consistently register the threats. That can mean that threats are forgotten by the team. When performing tool-based STRIDE threat modeling, the identified STRIDE threats are automatically registered.
• Better follow-up of countermeasures from STRIDE threats because the countermeasures are automatically stored in the tool: Once we know what potential threats are to our application, IT system or business process. We should develop countermeasures (or security requirements) to ensure that the threats do not negatively affect us. If we register countermeasures or security requirements manually, it can be difficult to keep track of them (and importantly, of their current status). As time goes by it is impossible to truly understand and quantify our current status with respect to threats, countermeasures / security requirements, and their implementation status.

There are other reasons why tooling will help with STRIDE threat modeling:

• Overall better result in identifying potential threats: Using a STRIDE threat modeling tool will do a better job in identifying potential threats, and will improve the quality of the threat definitions themselves. Manual threat modeling often leads to poorer quality threats (such as defining descriptions of the threat, determining and describing the likelihood, determining and describing the impact, etc.). Automated tooling-based threat modeling will lead to better STRIDE threats.
• Overall better result in creating, managing, and implementing security requirements: Defining security requirements is difficult! In fact, most (enterprise-level) software & system development projects don’t actively define security requirements. Performing tooling-based threat modeling forces the team to develop security requirements, and manage them through the software development lifecycle.
• Better decision making: With clearer results using a threat modeling tool, your team will be able to make better decisions regarding potential threats, and how to solve them with security requirements. Using a threat modeling tool also forces a team to complete the threat modeling activities, and thus lead to actual decisions and conclusions at the end of the process (this is often not the case with manual threat modeling).
• Better visibility using clear results from threat modeling tooling: Once results and conclusions are known (in the form of threats and security requirements), it is essential to make those visible within your team, and in the case of a wider enterprise environment, to make it visible within the company. Threat modeling tooling can help with that, in the form of dashboards.

How the Threat-Modeling.com Tool Can Help

The threat-modeling.com tool can help you to perform automated STRIDE threat modeling and defines potential threats and security requirements much more effectively and efficiently than manual-based STRIDE approaches.

Sign up to our threat modeling tool, 100% free (all you need is your Email address to sign up).

As a result of using our threat modeling tool, you get:

• Easily identify and register STRIDE threats.
• Easily define and register security requirements (or countermeasures) to counter threats.
• Easily create a data flow diagram, to better understand data flows within the application, IT system or business process.
• Much more.

An overview of the threat-modeling.com tool. Assessments are a core part of the solution. This allows you to customize the threat modeling process for your business and technical situation.

A view of a data flow diagram in the threat-modeling tool. Diagrams can help you visualize data flows and convey understanding between team members.

What is STRIDE Threat Modeling

STRIDE threat modeling is a specific kind of threat modeling methodology (or method). It is a mnemonic of six types of security threats. Each letter of STRIDE stands for one of the six types of security threats:

• Spoofing
• Tampering
• Repudiation
• Information Disclosure
• Denial of Service
• Elevation of Privilege

STRIDE threat modeling is helpful because it can tell us ‘what can go wrong’ on the application, system, IT landscape, or business process that we’re (threat) modeling.

Alternative STRIDE Threat Modeling Tooling

There are a number of alternatives to the threat modeling tool, including:

• Microsoft Threat Modeling Tool
• OWASP Threat Dragon

These are both powerful alternatives to the threat-modeling.com threat modeling tool.

The Advantages of Using a Threat Modeling Tool for STRIDE Conclusion

Manual threat modeling is certainly a viable method. If your team has the right level of knowledge, the right amount of time available, and the commitment to perform manual threat modeling, then you should be capable of performing STRIDE threat modeling successfully.

However, in practice, it can be difficult to perform threat modeling effectively without the help of specialized threat modeling tooling.

Our threat-modeling.com tool can help you to perform automated STRIDE threat modeling. Go ahead and try it out for free!