Cloud, Security and Technology

 In the realm of cybersecurity, threat modeling plays a pivotal role in safeguarding systems and applications against potential risks. A well-constructed threat model provides valuable insights into vulnerabilities, attack vectors, and mitigation strategies. Let’s delve into what distinguishes a good threat model from a subpar one. Selecting the approach 1. Picking the right tool:  Selecting an appropriate tool for threat modeling is crucial in ensuring effective security analysis. In this article we will use the Microsoft Threat Modeling tool. Key consideration including  a. Scope: Consider tools that align with your scope—some cater to web applications, while others cover broader infrastructure. b. Ease of Use: Opt for tools that strike a balance between robustness and simplicity. Complex tools may overwhelm users, hindering adoption. Look for intuitive interfaces and clear documentation. c. Methodology Compatibility: Different threat modeling methodologies exist ...

I've been asked several times as to what are the building blocks to build a secure cloud solution. In my last 2017 blog I revisit the paper I wrote a while back called " 13 Effective Security Controls for ISO 27001 Compliance " and reconsider the 13 security measure that help meet compliance controls. One important update for this blog over the paper, is that I will not look at IaaS services a whole lot. Protecting a OS or VM has been done to death.   IMHO organizations need to get out of the business of managing the health of OS's/VM's and WebServices.  Moving to Containers with an orchestration engines such as Kubernetes , or Platform such as provided by Azure, or AWS is one of the best long term security investments. No more AV, Patching, or Host services maintenance…  The process is to get most companies away from the IT business, and into their core competency with a High tech offering that provide a capability on demand. Moving...

A while back I worked with a great Architect general guru of secure code. Adam Shostack who is a foremost expert when it comes to threat modeling . He does a great job in help educate us all in how you should plan a secure solution before you build it. A threat model should be seen as a key design element before code is started, similar to a floor plan in a house design. In this blog I wanted to illustrate the value and methods required to build a threat model, and tie it back to work I recently published, Payment Processing Blueprint for PCI DSS-compliant environments which included sample threat model for a cloud based PaaS solution. Wow, that’s great a free starter threat model to an architecture, what else can you ask for? What does it take to create your very own threat model? Think like an attacker, it’s important to see the problem from the attackers point of view when designing, or architecting a solution. For instance that includes thin...