Threat Modeling Systems and Related Methods Including Compensating Controls

• US 20190205544A1
• Filed: 02/07/2019
• Published: 07/04/2019
• Est. Priority Date: 05/17/2017
• Status: Active Grant

• Current Assignee: ThreatModeler Software Inc.
• Original Assignee: ThreatModeler Software Inc.
• Inventors: Agarwal, Anurag
• Granted Patent: US 10,664,603 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 16/26 Visual data mining; Browsing structured data
• CPC Class Codes: G06F 16/904 Browsing; Visualisation therefor for navigating the web G06F16/954; browsing optimisation for the web G06F16/957
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: G06F 3/04842 Selection of displayed objects or displayed text elements G06F3/0482 takes precedence
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

Threat modeling methods include, in response to receiving user input using computing device interfaces: storing threat model components, threats, and security requirements in a one or more database(s); associating each threat with a component; storing an indication of whether each security requirement is a compensating control; associating each compensating control with one of the threats; displaying a diagram of one of a system, an application, and a process, using visual representations of the components, the diagram defining a threat model, displaying a threat report displaying each threat associated with one of the components included in the threat model; and; displaying a report displaying each compensating control associated with one of the threats included in the threat report. Threat modeling systems include one or more computing devices coupled with one or more database(s) and having interfaces for storing, associating, displaying, and editing the components, threats, and security requirements in various ways.

Claims

1. A threat modeling method, comprising:

in response to receiving one or more user inputs, using one or more interfaces displayed on one or more displays of one or more computing devices communicatively coupled with one or more databases;

storing a plurality of threat model components in the one or more databases;

storing a plurality of threats in the one or more databases;

associating each threat with at least one of the threat model components through the one or more databases;

storing a plurality of security requirements in the one or more databases, including storing an indication of whether each security requirement is a compensating control;

associating each compensating control with at least one of the threats through the one or more databases;

displaying a relational diagram of one of a system, an application, and a process, using visual representations of one or more of the threat model components, the relational diagram defining a threat model;

generating and displaying a threat report displaying each threat that is associated through the one or more databases with one of the threat model components included in the threat model; and

;

generating and displaying a report displaying each compensating control that is associated through the one or more databases with one of the threats included in the threat report.

2. The method of claim 1, further comprising, in response to receiving the one or more user inputs, adding one of the threat model components to the relational diagram and automatically including each threat associated with the added threat model component to the threat report.

3. The method of claim 1, further comprising, in response to receiving the one or more user inputs, removing one of the threat model components from the relational diagram and automatically excluding each threat associated with the removed threat model component from the threat report except for threats also associated with other threat model components included in the threat report.

4. The method of claim 1, wherein the threat report displays a threat status for each threat indicating whether that threat has been mitigated.

5. The method of claim 4, wherein the threat report includes one or more input fields configured to, in response to receiving one or more user inputs, manually change each threat status.

6. The method of claim 4, further comprising, in response to receiving the one or more user inputs, removing one of the compensating controls from the relational diagram and automatically changing the threat status of at least one of the threats included in the threat report to an unmitigated status.

7. The method of claim 1, further comprising, in response to receiving a user selection of one of the compensating controls previously included in the relational diagram, displaying a mitigations interface displaying each threat included in the threat report and identifying which of the displayed threats are mitigatable by the selected compensating control.

8. The method of claim 7, further comprising, in response to receiving one or more user inputs using the mitigations interface, altering which of the displayed threats are mitigatable by the selected compensating control.

9. The method of claim 7, further comprising, in response to receiving one or more user inputs using the mitigations interface, changing a threat status, of each threat mitigatable by the selected compensating control, to a mitigated status.

10. A threat modeling system, comprising:

one or more computing devices communicatively coupled with one or more databases, the one or more computing devices displaying, on one or more displays of the one or more computing devices;

one or more input interfaces configured to, in response to receiving one or more user inputs, store a plurality of user-defined threat model components in the one or more databases, store a plurality of threats in the one or more databases, associate each of the threats with at least one of the threat model components through the one or more databases, store a plurality of security requirements in the one or more databases including an indication for each security requirement indicating whether it comprises a compensating control, and associate each compensating control with at least one of the threats through the one or more databases;

a diagram interface configured to, in response to receiving one or more user inputs, diagram one of a system, an application, and a process, using visual representations of the threat model components stored in the one or more databases, to define a threat model;

a threat report interface including a threat report displaying each threat that is associated through the one or more databases with one of the threat model components included in the threat model; and

;

a compensating control report displaying each compensating control that is associated through the one or more databases with one of the threats included in the threat report.

11. The system of claim 10, wherein the threat report comprises a table displaying, for each displayed threat, a risk level, a threat status indicating whether that threat has been mitigated, and a source.

12. The system of claim 11, wherein the threat report comprises one or more input fields configured to, in response to receiving one or more user inputs, manually change the threat status of a selected threat.

13. The system of claim 10, wherein the compensating control report comprises a table displaying, for each displayed compensating control, a mitigatable threat, a source for the mitigatable threat, a risk level for the mitigatable threat, and a threat status indicating whether the mitigatable threat has been mitigated.

14. The system of claim 10, the one or more displays further displaying a threat tree visually depicting each threat model component included in the threat model, each threat associated with that threat model component depicted branching from that threat model component, and each compensating control associated with that threat depicted branching from that threat.

15. The system of claim 10, wherein the one or more input interfaces are further configured to, in response to receiving the one or more user inputs, associate each threat model component with one or more of the security requirements through the one or more databases.

16. The system of claim 10, wherein the diagram interface is further configured to, in response to receiving the one or more user inputs, diagram a communication protocol between two diagrammed threat model components, the diagrammed communication protocol including an alphanumeric indicator of the communication protocol.

17. The system of claim 10, the one or more displays further displaying a mitigations interface displaying all threats included in the threat report that are associated through the one or more databases with a selected compensating control, the mitigations interface identifying which of the displayed threats are mitigatable by the selected compensating control.

18. The system of claim 17, wherein the mitigations interface comprises one or more input fields configured to, in response to receiving one or more user inputs, alter which of the displayed threats are mitigatable by the selected compensating control.

19. The system of claim 17, wherein the mitigations interface comprises one or more input fields configured to, in response to receiving one or more user inputs, change a threat status, of all threats mitigatable by the selected compensating control, to a mitigated status.

20. A threat modeling system, comprising:

one or more computing devices communicatively coupled with one or more databases, the one or more computing devices displaying, on one or more displays of the one or more computing devices;

one or more input interfaces configured to, in response to receiving one or more user inputs, store a plurality of user-defined threat model components in the one or more databases, store a plurality of threats in the one or more databases, associate each of the threats with at least one of the threat model components through the one or more databases, store a plurality of security requirements in the one or more databases including an indication for each security requirement indicating whether it comprises a compensating control, and associate each compensating control with at least one of the threats through the one or more databases;

a diagram interface configured to, in response to receiving one or more user inputs, diagram one of a system, an application, and a process, using visual representations of the threat model components stored in the one or more databases, to define a threat model;

a threat report interface including a threat report displaying each threat that is associated through the one or more databases with one of the threat model components included in the threat model;

a compensating control report displaying;

each compensating control that is associated through the one or more databases with one of the threats included in the threat report;

the threat included in the threat report that is associated with that compensating control (mitigatable threat), and;

a threat status for each mitigatable threat indicating whether it has been mitigated, and;

a mitigations interface displaying all threats included in the threat report that are associated through the one or more databases with a selected compensating control, the mitigations interface identifying which of the displayed threats are mitigatable by the selected compensating control, the mitigations interface comprising one or more input fields configured to, in response to receiving one or more user inputs, change the threat status of all threats mitigatable by the selected compensating control to a mitigated status.