Last year, global cyberattacks increased by 38% when compared to 2021. As the threat landscape grows, we’re also seeing an evolution in threat actors. Overall, actors are more agile and sophisticated, exploiting vulnerable mobile applications across nearly every industry. A mobile application and its endpoints are a critical and vulnerable aspect of an organization’s entire system. To protect applications and their larger infrastructures from these threats, it’s important to implement threat modeling.
Threat modeling is based on the fundamental concept that you cannot defend or protect against what you don’t understand. Threat modeling enables you to properly understand the overall threat landscape your systems are facing, not just mobile threats, but how these threats could impact your API endpoints and backend infrastructure. Leveraging this understanding can help you develop the appropriate mitigation strategy. Companies use threat modeling to optimize a mobile application’s security by identifying security objectives and vulnerabilities and mitigating their effects. In other words, threat modeling helps you think like an attacker and gain a better understanding of how malicious threat actors can take advantage of your app’s vulnerabilities and exploit them. While the purpose of building a threat model is clear (better understanding of the threat landscape and the specific ways it can affect your app) there are many ways to approach the process of threat modeling.
It’s difficult to properly secure your app without an in-depth understanding of potential threats and how they’ll interact with your mobile application. Failing to practice threat modeling can expose your application (and organization) to greater cyberattack risk, loss of revenue, and negatively impact your brand reputation. In fact, between 2021 and 2022, the median cost of a single attack (e.g., breach, malware, ransomware attack, etc.) rose more than 29%. Additionally, the Hiscox Cyber Readiness Report from 2022 also states that 47% of all U.S. businesses suffered a cyberattack in some form or another during the past year. Mobile app security should be a priority for every developer and their teams, and threat modeling is a perfect foundation for building your app’s security strategy.
With a better idea of what you stand to lose without threat modeling, let’s take a deeper look at its benefits, the basics of building a threat model, and how to choose the right one for your mobile app.
We know what happens if you fail to implement threat modeling, but what are the benefits? Planning a security strategy based on an in-depth understanding of the threat landscape and how it affects your app offers the following:
It’s nearly impossible to comply with internal and external requirements without evaluating and mitigating threats. Compliance is particularly important in highly regulated industries like healthcare and financial services, but mobile applications across every industry can benefit from internal regulations that help prevent misconfigurations and other vulnerabilities that lead to serious security issues.
Imagine you’re building a home and want to properly secure it. Analyzing potential threats to your home (e.g., flood, fire, earthquake, etc.) before you begin to build can help you construct a more secure home from the ground up. Applying security measures to your home after it’s built is more difficult — like trying to reinforce a foundation after the home is complete. In the same way, threat modeling lays out a plan for securing your app before it’s built, allowing you ample opportunity to build in security features as you develop, instead of when the app is complete, which can take considerable time and money.
Threat modeling helps reduce your app’s attack surface. Considering how potential threats can affect your mobile app prior to development can help you identify the components of your app that need to be protected and those that do not. To revisit our home metaphor, threat modeling tells you that you need to fortify your front door, while a second story window doesn’t require as much protection.
Threat models are meant to catch both malicious events (like tampering or reverse engineering) and incidental (like an unsecured SDK). Implementing threat modeling at the beginning of the development process is a great example of how shifting left can help lower cybersecurity costs.
The Open Worldwide Application Security Project (OWASP) recommends beginning the threat modeling process with a Four Question Framework:
How you and your team answer these questions can help guide you to a suitable threat modeling method. Regardless of the method you choose, OWASP recommends that your threat model include the following three components: documentation of data flows, documentation of potential system threats, and documentation of security controls.
Once you’ve considered the framework questions, looking at popular threat models and considering how effectively they help you answer the framework questions can help you decide which model is best for your app. Here are some of the more popular threat modeling frameworks.
Choosing the right threat model for your app can be a confusing process. Even after you answer the OWASP framework questions, or consider the models that can help you answer the questions best, it still may not be clear which model you should pursue. It’s helpful to remember that you don’t need to choose just one model. Attack trees for example, are often used in concert with other threat models because they offer a simple way to visualize threats.
In addition to using more than one threat model at once and answering the framework questions, you should also consider the focus of each threat model. Threat models usually fall into one of three buckets: asset-centric, attack-centric, or software-centric.
After evaluating threat modeling focus areas, you may want to consider each methodology’s ability to scale, its report-generating capacity, your gauge of effectiveness, and the desired outcome. Factoring in the biggest vulnerabilities in your mobile app’s industry can also help you choose the right threat model.
Ex. 1 Gaming apps: gaming apps are often susceptible to piracy and cheating. STRIDE, then, could be a good threat modeling option as it deals with tampering (where attackers modify components of your code) and elevation of privilege (where attackers grant themselves additional privileges).
Attack Trees could also be effective as they could help your team visualize the paths that attackers would follow in your app. For example, if they’re looking to reverse engineer your app, you’d build a “tree” with that particular attack goal as a root and the possible paths as branches.
Ex. 2 Financial services apps: Financial services apps are susceptible to application repackaging, cloning attacks, weak encryption, and insecure data storage. STRIDE would be an effective model here as well, as it deals with information disclosure.
PASTA would also work. It leverages threat data to support prior threat patterns and has a focus on probability of attack and impact of compromise, which is key when dealing with PII.
Once you’ve selected a threat model and identified the threats most pressing to your mobile application, you’ll want to choose security solutions that can help resolve and remediate the potential threats facing your app. Your chosen tools should: offer scalability, automate your selected framework’s security suggestions (e.g., STRIDE, VAST, PASTA, Trike, etc.), and layer your app’s security. After all, the threat landscape is broad (and it’s growing); you’ll want to ensure that your app has every possible advantage to protect against attackers.
Threat modeling is a crucial part of developing mobile applications. It positions you to think as an attacker, which helps protect your app against current risks. An effective threat model also establishes processes to identify patterns/trends to help you protect against future threats.
Perhaps the most important benefit is planned security. Building a threat model at the beginning of the development process can save time, protect your app during and after the development process, and help you avoid penalties, fines, and other negative consequences of cyberattacks or exploited vulnerabilities.
Executive Summary (TL;DR)