Page 180 - Cyber Defense eMagazine Annual RSA Edition for 2024

Source: https://www.spiceworks.com/it-security/network-security/articles/what-is-threat-modeling-
definition-process-examples-and-best-practices/

1. Set Objectives: Security as the North Star

• Business Alignment: Identify how robust cloud security supports your company's core goals. Are
you protecting customer-sensitive data, ensuring system uptime, or demonstrating rigorous
protection for market leadership?
• Compliance Focus: Outline which regulations (e.g., HIPAA, PCI DSS, GDPR, etc.) apply to your
cloud operations based on your industry and the data you handle.
• Cloud Model Assessment: Determine how your specific cloud model (IaaS, PaaS, SaaS) impacts
your security needs and responsibilities.

2. Visualize: Map Your Cloud Kingdom

• Comprehensive Inventory: List every cloud asset (virtual machines, databases, containers,
serverless functions, etc.), their interactions, and cloud provider configurations.
• Hybrid/Multi-Cloud Complexity: Pay extra attention to how data flows and security controls differ
when you have multiple cloud providers or on-premises integration points.
• Compliance Checkpoints: Map the movement of regulated data within your system, ensuring it
aligns with the requirements you outlined in Step 1.

3. Identify Threats: Think Like a Cloud-Aware Attacker

• Beyond the Usual Suspects: Consider threat vectors unique to cloud or exacerbated by it -
misconfigurations, compromised cloud accounts, supply chain vulnerabilities.

180