Threat modeling 🦠

With cyber threats growing every day, defending against them matters. Today's offices are digitally overloaded. Almost every…

With cyber threats growing by the day, defending against them is essential. Today's offices are digitally saturated. Almost every activity depends on some form of technology and data sharing. Attackers can reach this data through many paths — a smartphone, a cloud app, a computer, a phishing attack, etc.

Attackers are believed to be able to breach 93% of company networks.

One process that helps companies fight back is threat modeling. It's a system for identifying threats and vulnerabilities affecting the company's operations or assets. The goal is to lower the risk of costly cyberattacks.

How do you implement threat modeling?

1. Identify what most needs protecting. The first step is identifying your most important assets — sensitive data, intellectual property, financial information. It's also important to secure company email and train staff on phishing.

2. Identify how those assets could be attacked. Common threats include cyberattacks, phishing, ransomware, malware, etc. Remember, threats aren't always intentional. Human error is the cause of roughly 88% of data breaches. So make sure you're aware of error-related threats too, like:

• Using weak passwords

• Vague cloud-usage policies

• Insufficient employee training

• Bad or missing BYOD policies (use of personal devices)

3. Assess the likelihood of an attack and the scope of potential damage. Once you know how attackers might come at you, determine:

1. What's the likelihood of being attacked?

2. What happens once you're attacked? Today it isn't a question of "if" but "when". You'll get the most accurate read on how attackers will hit you from an IT specialist, or — less accurately — through a network vulnerability test.

Work by priority

Most companies can't tackle everything at once due to time and money constraints. So sort the individual fixes by their impact on your cybersecurity. Prioritize the items with the highest impact over less important ones. Common strategies include:

• Access controls

• Firewall

• Intrusion detection

• Regular employee training

• Endpoint management

Continuous review and updates

Threat modeling isn't a one-off. Cyber threats evolve and improve every day, so you have to evolve with them — ideally one step ahead.