Threat Modeling Should Be Ingrained

Security pros can’t ever quit considering what sort of threats their organizations may be exposed to. Bruce Schneier makes that point while noting that a robber bored a hole through the wall of a jewelry shop in Tokyo’s Ginza district and got away with 200 luxury watches worth 300 million yen ($3.2 million).

From his book Secrets and Lies, Schneier recaps:

“Threat modeling is, for the most part, ad hoc. You think about the threats until you can’t think of any more, then you stop. And then you’re annoyed and surprised when some attacker thinks of an attack you didn’t. My favorite example is a band of California art thieves that would break into people’s houses by cutting a hole in their walls with a chainsaw. The attacker completely bypassed the threat model of the defender. The countermeasures that the homeowner put in place were door and window alarms; they didn’t make a difference to this attack.”

So keep thinking, imagining the worst. And figure out how to avoid it if possible.