Threat Modeling Made Simple: Method Aimed at Non-Experts

Every year, billions of IoT (Internet of Things) devices connect to the Internet, and research indicates that only about half of them undergo a security assessment before entering the market. One significant reason for this shortfall is the associated costs of conducting security assessments. This study suggests a device-centric approach to threat modeling, aiming to reduce the expenses related to this process by reducing the necessity for extensive security expertise and potentially pave the way for automation as a future work. Through a system abstraction employing a white-box model, the input paths of the system are represented in a technology-centric manner, providing opportunity for methodical threat modeling facilitated by a technology-centric threat database. This method is specifically designed for IoT or CPS devices. The method's output is designed to be easy to interpret, thus targeting engineers with limited security knowledge for practical usability.