THREAT MODELING THE TRAIL OF BITS WAY

Summary from the TLDR InfoSec newsletter

Trail of Bits' TRAIL (Threat and Risk Analysis Informed Lifecycle) is a threat modeling process that merges aspects of Mozilla's Rapid Risk Assessment, NIST SP 800-154, and NIST SP 800-53 to identify design-level security flaws. TRAIL constructs a model of system components and trust boundaries, documents threat scenarios of potential adversary exploitations, and generates actionable findings with short- and long-term mitigation recommendations. It addresses root causes at the architecture level, allowing clients to adapt their threat models as systems evolve and offering vital security insights throughout the software development lifecycle.