Work Item: Threat Modeling Guide (TMG)

[simoneonofri]

As specified in the charter, one of the group's objectives is to create the Threat Modeling Guide, to streamline the development of a Threat Model for various standards, the results of which are then included in the Security Consideration sections.

In addition, the guide may also be useful for analyzing other types of threats such as privacy, harms, sustainability, etc.

Due to its structure, it is also useful to have a Threat Model for the Web so as not to start from scratch. This is a separate document in the charter, so we are also working on these aspects.

[cc'ing @jandrieu]

[TomCJones]

"the web" is not a thing - not sure how to model something that has no scope limits. My suggestion is to break this into two tasks.

1. Model a web app
2. Model a web protocol
   i put some outlines here: https://github.com/TomCJones/threat-modeling/tree/main/models

[simoneonofri]

Hi @TomCJones, in the context of the Threat Modeling Guide, we are drawing inspiration from RFC 3552 - already linked in the Security and Privacy Questionnaire - which in section 3 has a small Threat Model (Threats) for the Internet.

And we are designing a Threat Model for the Web, also to provide a boilerplate for spec developers so that a Web API can be easily added and its threats assessed.

@jandrieu and I are considering whether to have more boilerplates that serve slightly different purposes, considering that “all models are wrong, some are useful” from statistician George Box (1976), quoted by Shostack (2014)

Web APIs

For example, an intermediate-level Threat Model for the Web like this one, a simpler one, and a more in-depth one to study various issues (e.g.,: what happens if a Web API is loaded within an iframe, or if you try to access it in a certain way).

File formats

Having also carried out a Security Review of Verifiable Credentials Data Model, in this case we are talking about a file format, which may also be displayed in a browser, and which potentially has a Threat Model (Threats) for the File Format, currently structured as follows:
Threat Model for the file format:

• PLS: Parsing/Loading/Serializing
• CD: Compression/Decompression
• EEC: Embed Executable Code (e.g., scripts)
• LER: Links and external resources
• MM: Metadata manipulation
• DI: Data Integrity

Another good example of file formats is ePub.

Protocols

In relation to protocols, a good starting point is definitely RFC 3552 - Section 3.

Cryptography

Other elements include cryptography, on which Patrick has developed several interesting points.