Blog provided by Electric Kitten

Threat modelling is an important part of any IT infrastructure team. Often, IT infrastructure is at the mercy of the services that it on top of it. If a single web app or microservice is beached, then the rest of the system can soon follow. With a proper threat model, your team can proactively understand what could go wrong and how to manage that weakness. Let’s look at a basic approach to a threat model:

The team

You need the right team in place. The team should include someone from each system that is a part of or connected to any IT system. You should end up with system owners, developers, testers, and even members of the HR and finance teams.

The model

Start modelling your systems but keep the boundary small for the start. The larger the boundary the harder it is to model all your threats. The model boundary can also serve as a limit on who should be on the team. Start with the threats and vulnerabilities of external facing systems. Then proceed to possible internal threats. Then document the impact of each.

Mitigations

Now that you have a list of possible threats and vulnerabilities, make a list of mitigations for each, and the party responsible. One example of a threat and mitigation are open ports on your hosted servers. This is a critical vulnerability and is easily mitigated by ensuring that only certain ports are open.

Now that you have threat model, and mitigations in place, review this at least every quarter and update for new threats, new systems, and any other risks that come up in the interim.

If you need an LA colocation or dedicated server provider you can trust, contact Electric Kitten today. They’ve provided reliable web hosting services for almost two decades. If you are located in the Southern California area, give them a call.