Insights

At a Glance: Certus Cybersecurity was engaged by one of the largest banks in the world to execute threat modeling exercises for parts of their infrastructure.

Services Provided

Certus Cybersecurity provides the services of its employees to execute threat modeling exercises. The scope of the assessment encompassed various cloud and onsite environments and application services. As a result, three kinds of threat models were produced during the engagement:

• The base threat models were built from scratch for existing services, environments, and applications.
• The differential threat model was created based on previous threat modeling work, which required adjustments due to changes in the initial scope.
• The blueprint threat model was built from scratch for services and components used in various applications and architectures across the company’s technological environment.

Results

• Identification of various high severity threats in cloud components leveraged by multiple applications across the internal and external facing environment.
• Identification of architectural, configuration, and implementation flaws for different applications and services.
• Recommendation of proper mitigation steps to minimize the exploitation risk or every identified threat scenario.
• Generation of blueprint threat models leveraged by the security team for any threat model being made containing associated components.