Automating Threat Modeling through the Software Development Life-Cycle

Fixing software security issues early in the development life-cycle reduces its cost dramatically. Companies doing software development know this reality, and they have introduced risk assessment methodologies in their development processes. Unfortunately, these methodologies require engineers to have deep software security skills to carry out some of the most important steps of this process, and training them on security is expensive. In this scenario, we propose a new automated approach to analyze software designs to identify, risk rank and mitigate potential threats to the system. We designed a new data structure to detect threats in software designs called Identification Tree. We also defined a new one for describing countermeasures to threats, called Mitigation Trees. Our automated approach relies on Identification Trees and Mitigation Trees to integrate a guided risk assessment process through the development life-cycle. It does not require developers to have any security training, and was integrated in the current Threat Modeling process of Microsoft. Keywords— risk analysis, threat modeling, attack patterns, identification trees, mitigation trees