Understanding Threat Model and OWASP

Right from the start, until the application is being used in production, it's exposed to different kinds of threats. These different kinds of threats can break the application from being successfully used. Therefore, it is important to address the threats.

Threat Model

The approach to identify and classify, and the process of addressing the threats is called Threat Modelling. The outcome of this process is a Threat Model. This process is not merely related to code review, following coding standards, or deployment processes.

Threat Modelling comprises more of analyzing the security of an application, and it's more result-oriented when it starts in the early stages of SDLC. The threats rise from written code, deployment strategy, environment, other applications, and hardware failure.

Broadly, the threats can be grouped in three categories based on their nature: decomposing the application, ranking the threats, and strategies counter measures and mitigation...