HyVAW : a hybrid vulnerability analysis workflow threat model methodology for complex systems based on distributed components

Threat modeling is an essential tool for the quality of produced software artifacts, bringing maturity to the design process. However, even though several threat modeling methodologies are used, the evolution of the complexity of new technologies, such as microservices, APIs, and other distributed components, demands new challenges. Our methodology provides a comprehensive workflow aggregating existing methodologies such as STRIDE, CVSS, and ADT in a hybrid format and distinct modeling phases. With this approach, through easy traceability and maintenance, it was possible to visualize each component's global and specific threats and the relationship between the components and countermeasures for each threat. As a result, HyVAW proved to be suitable for analyzing the different threats in each part of the proposed system and mainly for communication between the parts of the security mechanism through exemplification using a distributed project and through a comparison with other related works.