Week 12 - The Final Words

Finally, I get to take a week of break.  This is the busiest Term so far.  Lots of demands from work plus things keep breaking at home made it tough.  I am glad it over.  With that said, I learned much from this class.

In the first four weeks, I got to understand the threat modeling process and different threat modeling tools.  In a nutshell, threat modeling is about understanding your current state of the network; find all vulnerabilities, threats, and risks; formulate action plan and priority.  The process is carried out in a systematic way.  Initially, I thought the threat modeling is a process for finding the threats.  The name sounds small, but it also covers asset identification and action planning, as I realized after the comment on my assignment. 

I spent the following weeks working on a security project where I apply the threat modeling process.  The first phase in threat modeling is the asset assessment, where I found all assets along with their interconnections, existing security conditions, and identify the potential vulnerability.  Coming out from the first phase is the network diagram showing the current infrastructure, the criticality of each asset, and the list of vulnerability.  The second phase is finding threats.  The starting of this phase is a data flow diagram that would allow me to understand where data would reach.  Using the STRIDE model (one of the methods to find threats), I walked through each vulnerability and identify whether it is vulnerable to spoofing, tampering, repudiation, information disclosure, denial of service, elevation of privileges, or a combination of some of them.  There are other methods of identifying the threats, but we didn’t have a chance to go into details.  After threat identification is the assignment of severity, impact level, risk analysis.  The third phase is the action plan, where solutions are formulated, and prioritization is computed.

In general, I like the way the class assignment is set up, where each assignment is divided into two weeks.  The first week is for students to leave opinions and the second week is the final submission.  This arrangement allows students to learn better and understand more about the subject.  I also like the fact that students get to pick what topic to write on their blog.  I used that opportunity to pick the subjects that I want to know more about.  The last thing I like about this class is that students get useful comments from the professor.  The comments helped them learn the mistakes as well as gaining knowledge about the subject.

When I signed up for the course, I thought it would emphasize on security trend.  I found out that it is about threat modeling.  However, if it were to talk about the trends, it wouldn’t have academic benefit, in my opinion.  I am glad it is about threat modeling.  I found it difficult to keep up with the assignment sometimes.  Part of it was because I had lots of other things demand my time at the same time.  If I were to take this class again, I would make use of the winter break to get some of the work done.