Threat Modeling in Thirty Minutes

There is no shortage of articles about OWASP ZAP. Most of them cover the happy path. This one is about what happened after the happy path ended.

The setup was ordinary: OWASP ZAP at the edges, Vault doing most of the heavy lifting, and a handful of scripts nobody wanted to own. It worked well until usage roughly doubled over a single quarter.

What was going wrong

We had good intentions. We even had a document describing how threat modeling should work. The trouble was that the document and the code had quietly gone their separate ways.

Most of the complexity was accidental. Over the years we'd layered three different approaches to threat modeling on top of each other, and each one made sense at the time.

Trying something different

Rather than a big-bang rewrite, we migrated one module at a time over about 10 weeks, keeping both paths alive behind a flag.

Stripped of the project-specific bits, it looks like this:

cosign sign --yes ghcr.io/acme/api@sha256:3f1c...
cosign verify \
  --certificate-identity-regexp 'https://github.com/acme/.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  ghcr.io/acme/api@sha256:3f1c...

This alone let us delete a surprising amount of code elsewhere in the project.

A few things that helped along the way:

• Delete dead code aggressively; it's the cheapest refactor there is.
• Make the default the safe choice, not just the documented one.
• Agree on what "done" means before the first pull request.
• Pair on the first few changes so the knowledge doesn't live in one head.

Caveats

We still haven't solved supply chain security. That's a post for another day, and honestly, I'm not sure we'll get it right the first time either.

None of this is free. The new approach is a bit more verbose, and newcomers occasionally ask why we don't just use Semgrep for everything. That's a fair question with a boring answer: we tried, and it made threat modeling harder to reason about.

Closing thoughts

Six months in, nobody on the team wants to go back. That's about the best review a change like this can get.