Introduction to Threat modelling

Good quality penetration tests have two things; a deep understanding of the target, and an idea of a threat model - formalised or otherwise. This talk intends to introduce the concept of threat modelling; which will help develop skills and informal models of how to approach attacking a system when very little of systems, processes or applications are known.

This talk will endeavour to teach penetration testers (and others) to critically think about their targets, what matters to them and what keeps them up at night - which ultimately leads to penetration testers making these bad things happen to their targets.

A threat model is the idea of the target system, what can go wrong, what we can do about it, and measuring if the controls work - at least according to models such as Shostacks’ 4 question frame.

At the point penetration testers are engaged, we mostly care about the first two - what is our target, and what can go wrong. Ultimately, our goals are to make these bad things happen, and find bugs before the bad guys(TM) do.

This talk is not intended to be the implementation of STRIDE, TRIKE, PASTA or VAST. If you know what these are, this probably isn’t the talk for you.