Threat Modeling and Its Applications to Physical Security

Threat modeling is a technique used in software design to anticipate potential threats, identify vulnerable aspects of the system, and determine how to defend against them. Though used primarily in computer programming, the theoretical concept behind threat modeling could also apply to the design and implementation of physical security systems, such as barricades from Delta Scientific.

What Are the Steps Involved in Threat Modeling?

Threat modeling has many different goals, such as identifying potential vulnerabilities and quantifying the severity of the security threats faced. The threat modeling process uses four steps to achieve these goals: diagram, identify, mitigate, and evaluate.

To diagram is to identify the end result that the threat modeling should ideally achieve. The next step is to then identify potential threats that could attack or weaken the system. Once the threats have been identified, mitigation involves coming up with potential defenses against each of the identified threats. The final step is validation, which confirms that each of the previous steps has been carried out.

What Are the Benefits of Threat Modeling?

Threat modeling allows software developers to identify security requirements and evaluate new threats. It allows them to identify design flaws and other problems early in the process. The earlier they identify the problems, the more quickly they can solve them to put out a product that is ready to stand up to online threats.

How Is the Threat Modeling Process Applicable to Physical Security?

There are several steps in the threat modeling process that are similar to what we do at Delta Scientific when developing a new physical security product:

• Identify potential threats, particularly vehicles used as weapons in ramming attacks and sometimes bad actors on foot.
• Prioritize the threats, which depend on the facility and the situation. For example, a vehicle threat might seem like a greater threat, but if the facility is a repository for sensitive information, a bad actor on foot that could steal or corrupt the files could end up being a greater priority.
• Diagram or design a barricade that can withstand the threat.
• Mitigate the threat with a barricade that can stop a vehicle traveling at a great velocity.
• Validate the product with crash testing to determine the top vehicle speed at which the barricade will remain effective.

Is Threat Modeling an Ongoing Process?

In software development, threat modeling isn’t only carried out before the finished product is complete. It continues after deployment to check that there are no lingering problems that didn’t get worked out during the development process. Similarly, we continue to do testing of our products after they are completed, constantly looking for ways that we can improve them. This approach is necessary as terrorist threats continue to become more sophisticated; security products have to evolve to be able to deter the new threats.

What Is the Ultimate Objective of Threat Modeling?

Ultimately, the objective of threat modeling is to protect something of value. In a software context, it is typically data that is valuable. In the context of physical security, it is tangible assets and human lives, which are irreplaceable.

Sources:

https://www.synopsys.com/glossary/what-is-threat-modeling.html

https://owasp.org/www-community/Threat_Modeling

PreviousNext

Recent Posts