CISO Shares a Four-Question Framework for Practical Threat Modeling

Summary

Former CISO Lora Vaughn recommends ranking business risks, identifying likely attackers, finding overlap between the two, and choosing the least costly control that disrupts each scenario. She advises refreshing the model quarterly or after major changes.

Key points

• Rank potential outcomes by business impact, from existential to painful or annoying.
• Assess likely attackers and relevant exposures using sources such as CISA and industry ISACs.
• Combine high-impact outcomes with likely threats to define scenarios, including who is attacking, how, what is targeted, and the cost.
• Prioritize the least costly effective control; examples include phone verification for business email compromise and multifactor authentication.
• Maintain an asset inventory, patch known-exploited bugs, limit administrator access, test backups, and use network segmentation alongside ransomware backups.
• Involve management, present priced investment options, and describe security spending as reducing risk rather than guaranteeing security.
• Refresh the threat model quarterly or after a major change.

People