Threat modeling systematically identifies threats, vulnerabilities, likelihood, impact, security controls, and countermeasures affecting an API or software system. It evaluates risk by considering both the probability of an occurrence and the damage it could cause. section 10.2.1
Use these terms to distinguish the parts of an API security analysis:
- Threat: a potential occurrence that could damage or compromise a business asset or objective. section 10.2.1
- Vulnerability: a weakness in implementation that makes exploitation possible. section 10.2.1
- Attack: an attempt to steal, expose, modify, destroy, disable, or gain unauthorized access to a system or asset. section 10.2.1
- Countermeasure: an action that reduces the probability of attacks or the impact of threats. section 10.2.1
- Attack vector: the channel used to carry out an attack, such as a client browser or network proxy. section 10.2.1
- Actor and impact: the actor performs functional use or abuse, while impact measures the damage caused by an attack. section 10.2.1
Apply security checks throughout API design, development, testing, and runtime operation. Encryption, authentication, authorization, audit logging, and rate-limiting are among the controls used to protect APIs against vulnerabilities. section 10.2.1
Abusing a sensitive business flow
An attacker could purchase most available airline tickets without cancellation fees, cancel them near departure, and then buy one ticket at the resulting discount. Linting cannot detect this business-flow abuse, but threat modeling can expose the risk and prompt controls such as rate-limiting, monitoring, client or IP restrictions, CAPTCHA, and other human-detection measures. section 10.2.7
Figure 10.4 The main stages of threat modeling
Use the figure to navigate the main stages associated with threat modeling. section 10.2.1
