Threat modeling: As easy as OATMEAL

Threat actors are constantly evolving their tactics, techniques, and procedures (TTPs), which often makes understanding and mitigating potential threats a daunting task. Traditional threat modeling frameworks can fall short or even be seen as intimidating to defenders trying to model potential threats. This is often due to the complexity or amount of effort and knowledge required to build threat models. Additionally, many threat models limit the potential audience due to overly complex or detailed presentations, limiting the overall effectiveness of the model.

To bridge this gap, we have developed the OATMEAL threat modeling framework. OATMEAL stands for Overlays And Threat Modeling Events And Limitations, and it is designed to provide a comprehensive, yet straightforward and unintimidating approach to threat modeling.

This layer shows the controls that are currently in place to prevent undesired actions. Controls are depicted as transparent boxes over the parts of the environment they protect. This helps identify where controls are effective and where gaps may exist.

• Types of controls include firewalls, intrusion prevention systems, access controls, encryption, and other security measures.

• Coverage indicates which parts of the environment each control protects, ensuring a clear understanding of the control landscape.

Duplicate the overview slide and add a layer for currently implemented controls. Use transparent boxes to indicate the areas covered by each control.

This layer highlights the detections that are in place to alert on potential malicious activity. Detections are categorized into "generic or out-of-the-box" and "specific or custom-made" detections. This helps in understanding the visibility over the environment.

• Generic detections include standard detection rules provided by security tools, such as antivirus software or intrusion detection systems.

• Custom detections include tailored detection rules designed to address specific threats unique to the environment.

Duplicate the overview slide and add a layer for currently implemented detections. Use transparent boxes (with a new color) to indicate the areas covered by each detection.

Based on the previous layers, this layer identifies known gaps in the environment — both from a control and detection perspective. Gaps are depicted using different colors to distinguish between control gaps, detection gaps, and combined gaps.

• Control gaps: Areas where preventive measures are lacking or insufficient

• Detection gaps: Areas where monitoring and alerting mechanisms are inadequate

• Combined gaps: Areas where both control and detection measures are lacking

Create a layer for control and detection gaps based on the previous layers. Use different colors to distinguish between control gaps, detection gaps, and combined gaps.

Most likely
This layer helps the analyst to identify the most likely scenario in which an attacker would try to compromise the environment. It combines analyzed threat actor activity, common TTPs, environment variables, known gaps, and controls. The goal is to prioritize recommendations and improve defenses.

• Threat actor activity: Analyze recent threat intelligence to identify common attack patterns and behaviors.

• TTPs: Use frameworks like MITRE ATT&CK to map out potential attack vectors.

• Environment variables: Consider unique aspects of the environment that may influence the likelihood of specific attack scenarios.

Most impactful
This layer helps the analyst identify the most impactful scenario in which an attacker would try to compromise the environment. It considers the potential damage or impact and helps prioritize recommendations based on the worst-case scenario.

• Impact assessment: Evaluate the potential consequences of an attack, such as financial loss, reputational damage, or operational disruption.

• Worst-case scenario: Identify the attack scenario that would cause the most significant harm to the organization.

Duplicate the overview slide twice, then add layers for the most likely scenario and the most impactful scenario. Identify and analyze these based on the controls, detections, and gaps previously identified. Use transparent boxes in a color not previously used and highlighted red arrows to indicate the path the attacker might take, as well as compromised services along the way.

The final layer provides actionable recommendations to improve the security posture of the environment. Recommendations are based on the identified gaps and are prioritized according to the potential impact scenarios and current mitigations.

• Actionable steps: Provide clear and specific actions that can be taken to address identified gaps.

• Prioritization: Rank recommendations based on their potential impact and feasibility.

• Implementation guidance: Offer practical advice on how to implement the recommendations effectively.

Based on the identified gaps and attack scenarios, provide actionable recommendations to improve the security posture. Use transparent boxes of a new color to indicate where recommendations should be applied.

While the visual overlays are instrumental in depicting various aspects of the environment, the addition of a narrative document significantly enhances the value of the OATMEAL framework.

The narrative document provides detailed explanations and context that complement the visual overlays. It helps stakeholders understand the rationale behind each layer, the significance of identified gaps, and the implications of potential attack scenarios. This deeper understanding is crucial for informed decision-making.

• Detailed explanations: Each control, detection, gap, and recommendation depicted in the overlays is explained in detail, providing clarity on their purpose and importance.

• Contextual information: The narrative includes background information and context that may not be immediately apparent from the visual overlays alone.
• Facilitates communication: The narrative document serves as a communication tool that bridges the gap between technical and nontechnical stakeholders. It translates complex security concepts into understandable language, making it easier for all parties to engage in meaningful discussions.
• Accessible language: The narrative uses clear and concise language to explain technical details, making it accessible to a broader audience.
• Structured format: The document follows the same order as the presentation layers, allowing readers to easily navigate to the sections they are most interested in.

The release and timing of any features or functionality described in this post remain at Elastic's sole discretion. Any features or functionality not currently available may not be delivered on time or at all.