THE SECURITY BRUTALIST

Brutalist Threat Modeling

A brutalist threat modeling approach is direct, focused on core assets and high-impact threats, and prioritizes actionable mitigations over exhaustive analysis. It's about quickly identifying the most damaging problems for the most critical assets. This provides a quicker understanding of the most significant risks to the most critical parts of the business, allowing for better prioritization of security efforts.

The process involves directness, by quickly identifying critical assets, functionality, by focusing on the most likely scenarios and more realistic threat actors based on their methods and threat intelligence, and the most fundamental security controls to prevent or mitigate those threats. It favors simplicity and speed over detailed diagrams and lengthy documentation.

This cuts through the noise and complexity to focus on what truly matters for immediate risk reduction. It acknowledges limited resources and the need for rapid, effective security improvements. It focuses on addressing the most important issues fast, using the controls already in place. It documents everything else that can't be mitigated.

Note: for a more concrete examples in support of a Brutalist Security program, check A Brutalist Threat Model Approach.

High Level Example

  1. Identify Critical Asset: Customer Database.
  2. Identify High-Impact Threat: External breach leading to data exfiltration.
  3. Identify Fundamental Controls: Strong encryption at rest and in transit, strict access controls (MFA, least privilege), robust intrusion detection on network perimeter and database access.1
  4. Action: Prioritize implementing and verifying these controls.

Advantages

This approach is fast and efficient, helping identify and addresses key risks, quickly. It's main focus is on action and reduction of risk, directly leading to the implementation of concrete security measures in support of a Brutalist Security program. This way of threat modeling is also resource efficient, since it doesn't require extensive time or specialized tooling, all it needs is an experienced security professional. Finally, it provides clear priorities: Focuses efforts on the most critical assets and threats.