Threat Modeling a Retail Environment

If you have followed this blog, or followed anything Microsoft has done with the Security Development Lifecycle, you’ll know that we are proponents of the benefits of threat modeling as a way to understand the risks to and potential mitigations for a system.

The computer industry is full of systems that look somewhat alike, and have similar “moving parts”; for example, banking, health care, telecommunications and so on. In the wake of high profile attacks on organizations in the retail industry, we thought developing new guidance that helps with the unique requirements and challenges of that industry could be helpful. We decided that the best way to do this was to team up cybersecurity expertise with retail expertise. We combined the security expertise of senior consultants Tim Delong, Mark Simos and myself from the Microsoft Consulting Services Cybersecurity team, with retail industry expertise of Vic Mile and Marty Ramos from Microsoft’s Retail industry vertical team.

 The paper we developed looks at a typical, large retail environment and builds a threat model on top of that environment. Given the threats we identified, the paper suggests some appropriate mitigations. I want to point out that we don’t pretend for a moment that this threat model exactly maps to every retail environment in the market today, but it does bridge the language gap between retail domain expertise and security expertise, or, as I often like to say, “It fixes the impedance mismatch.”

You can read the retail group’s post about the paper here, and you can download the paper from here.

Please feel free to share your constructive comments about the paper on our Twitter handle at @MSFTSecurity.

About the Author
Michael Howard

Principal Security Program Manager

Michael Howard is a principal security program manager on the Trustworthy Computing (TwC) Security team at Microsoft, where he is responsible for managing secure design, programming, and testing techniques across the company. Michael is an architect of the Security Development Read more »