Threat modelling, security awareness and capstone risk assessment

This final lesson covers the last two sub-domains of Domain 1 and then brings the whole course together. Sub-domain 1.10 asks you to understand and apply threat modelling concepts and methodologies; sub-domain 1.12 asks you to establish and maintain a security awareness, education and training program, including methods such as social engineering exercises, phishing simulations and gamification, periodic content reviews and measuring effectiveness. The capstone then walks through a complete risk assessment for a mid-sized organization, using governance, law, continuity, personnel, supplier and risk management ideas from earlier lessons.

What threat modelling is

Threat modelling is a structured way of thinking about what could go wrong with a system, before it goes wrong. It is most valuable early in design, when changes are cheap, but it can be applied to existing systems, business processes and even organizations. A widely used summary, from the Threat Modeling Manifesto, frames it as four questions: What are we working on? What can go wrong? What are we going to do about it? Did we do a good enough job?

A threat model usually starts with a diagram of the system, such as a data flow diagram showing processes, data stores, external entities, data flows and trust boundaries, the points where data moves between areas with different levels of trust, such as from the internet into a web server. Threats tend to cluster at trust boundaries. The team then identifies threats, rates them, decides on mitigations and records the results so they can be revisited when the design changes.

Threat modelling methodologies

STRIDE, developed at Microsoft, classifies threats into six categories, each the opposite of a security property: Spoofing (authenticity), Tampering (integrity), Repudiation (nonrepudiation), Information disclosure (confidentiality), Denial of service (availability) and Elevation of privilege (authorization). Teams walk through each element of the data flow diagram and ask which STRIDE threats apply.

PASTA (Process for Attack Simulation and Threat Analysis) is a seven-stage, risk-centric methodology: define objectives, define the technical scope, decompose the application, analyze threats, analyze vulnerabilities, model attacks, and analyze risk and impact. Because it starts from business objectives, it links threat modelling to risk management. DREAD, also from Microsoft, rated threats by Damage, Reproducibility, Exploitability, Affected users and Discoverability; it is now rarely used because its ratings proved subjective, but it still appears in study materials. VAST (Visual, Agile and Simple Threat modelling) aims to scale threat modelling across large agile organizations. Attack trees represent an attacker's goal at the root and the ways to achieve it as branches, which helps find the cheapest path for an attacker. MITRE ATT&CK provides a knowledge base of real attacker tactics and techniques that teams use to check that their models reflect real behaviour. LINDDUN applies a similar approach to privacy threats.

Security awareness, education and training

People are both a common attack target and a powerful line of defence. Awareness, training and education differ in depth. Awareness aims to change attention and behaviour across the whole workforce: recognizing phishing, reporting incidents, protecting passwords, following clean-desk rules. Training builds specific skills for particular roles: secure coding for developers, incident handling for responders, secure configuration for administrators. Education builds deeper understanding and judgment over time, such as degree programs and certifications like the CISSP.

Effective programs use varied methods: short, frequent modules rather than one long annual session; phishing simulations with immediate, supportive feedback; social engineering tests, such as pretext phone calls, conducted with management approval and care for employees' dignity; gamification, such as challenges and leaderboards; champions in each department; and messages tied to current events. Content should be tailored to roles and risks: finance staff need training on payment fraud and business email compromise; executives need training on targeted attacks and their own role in governance.

The outline stresses periodic content reviews that include emerging technologies and trends. Recent examples include generative AI, which makes phishing messages more convincing and enables voice and video deepfakes used to authorize fraudulent payments; QR-code phishing; multi-factor authentication fatigue attacks, in which attackers flood users with approval prompts; and rules for staff using AI tools with company data. Programs should be reviewed at least annually and after major incidents or changes.

In Canada, the Canadian Centre for Cyber Security and its Get Cyber Safe public awareness campaign provide free awareness material, and October is Cyber Security Awareness Month. Federal departments must provide security awareness under the Treasury Board Directive on Security Management, and Quebec's Law 25 and PIPEDA's safeguarding principle both make staff training part of reasonable privacy protection. OSFI Guideline B-13 expects financial institutions to maintain cyber awareness programs.

Measuring effectiveness

Completion rates alone show only that people clicked through modules. Better measures look at behaviour: phishing simulation click rates and, more importantly, reporting rates; time from receiving a real phishing email to its first report; number of incidents caused by human error; results of social engineering tests; and survey measures of security culture. Programs should set targets, compare against baselines and adjust content where results are weak.

Capstone: a risk assessment for Northfield Logistics

Northfield Logistics is a fictional company with 900 employees, warehouses in three locations, an online customer portal and a fleet of delivery trucks. It stores customer contact and delivery data, employee records and payment information processed through a card payment provider. Most systems run on one cloud provider; a managed service provider handles IT support. The board has asked the new CISO for a first enterprise security risk assessment.

Step 1, governance and scope: the CISO confirms that the board owns risk appetite, sets up a risk committee with operations, finance, legal and IT, and agrees scope (all business units) and criteria (a 1 to 5 likelihood and impact scale, with scores of 15 or above reported to the board). Step 2, obligations: legal counsel lists privacy and breach notification laws in each jurisdiction where Northfield operates, PCI DSS duties through the payment provider contract, transportation safety rules for fleet systems, and contractual security commitments to large customers.

Step 3, assets and BIA: the team identifies critical functions. Dispatch and route planning has an MTD of 8 hours and an RTO of 4 hours; the customer portal an MTD of 24 hours; payroll an MTD of 3 days. Step 4, threats and vulnerabilities: interviews, scans and threat intelligence identify ransomware, business email compromise, supplier compromise through the managed service provider, insider theft of customer data and a cloud region outage.

Step 5, quantify the top risk: Northfield estimates that a ransomware incident stopping dispatch for five days would cost $3.2 million in lost revenue, recovery and penalties (SLE), and expects such an incident once every three years without new controls (ARO of one in three, about 0.33), giving an ALE of about $1.07 million. A package of controls costing $350,000 a year is expected to reduce the ARO to 0.05 and the impact to $1.2 million, for an ALE of $60,000. Its value is about \( 1{,}070{,}000 - 60{,}000 - 350{,}000 = 660{,}000 \) dollars a year, a strong case.

Step 6, people and suppliers: background checks for staff with access to customer data and finance systems, automated deprovisioning tied to HR, a supplier tiering exercise placing the cloud provider, MSP and payment provider in the critical tier, and an SBOM requirement for the customer portal's vendor. Step 7, awareness: role-based training for finance on payment fraud, phishing simulations measured by reporting rate, and a threat model of the customer portal using STRIDE before its next release. Step 8, report and monitor: the CISO presents the top five risks to the board in business terms, with decisions requested and residual risks for formal acceptance, and sets key risk indicators for quarterly reporting.

Observe how every Domain 1 sub-domain appears: ethics in honest reporting, the five pillars in the risks themselves, governance in the committee and board decisions, frameworks in the risk method, law and investigations in the obligations list, policy in the encryption standard, continuity in the BIA, personnel and supply chain controls, risk management throughout, threat modelling for the portal, and awareness for finance and all staff.