Threat modeling

Once you have gathered information in the intelligence-gathering phase, you start working on threat modeling. In threat modelling, you begin to create a structure of threats and how they relate to your target's environment. For example, you will identify systems that hold valuable information, then you will identify the threats that pertain to the systems and what vulnerabilities exist in the system that can allow the attacker to act on the threat.

Threat modeling has a few methodologies, such as the following:

• Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege (STRIDE)
• Process for Attack Simulation and Threat Analysis (PASTA)
• Visual Agile and Simple Threat Modelling (VAST)

There are few tools that you can leverage for threat modeling; the most common being the following two:

• Microsoft Threat Modelling Tool: https://aka.ms/tmt
• OWASP Threat Dragon: https://www.owasp.org/index.php/OWASP_Threat_Dragon