True or False: Threat modeling techniques are only relevant during the initial development phase of a project.

Threat modeling is not a single, isolated activity performed only at the beginning of a project. It is an iterative and continuous process that should be integrated throughout the entire System Development Lifecycle (SDLC). While it is most cost-effective to perform threat modeling during the initial design and architecture phase, it must be revisited and updated whenever the system undergoes significant changes. This includes adding new features, altering the architecture, deploying in a new environment, or when new threat intelligence becomes available. A static threat model quickly becomes obsolete and fails to account for the evolving nature of software and the threat landscape.

The statement is false because it incorrectly confines threat modeling to a single phase. This "one-and-done" approach is a common anti-pattern in secure development. Modern security frameworks, including the Cisco Secure Development Lifecycle (CSDL), advocate for continuous security activities. Neglecting to update the threat model post-development means that any changes or newly discovered vulnerabilities will not be assessed, leaving the system exposed to unforeseen risks.

1. Cisco Systems, Inc., "Cisco Secure Development Lifecycle (CSDL)". While the primary threat modeling activity is in the Design phase, the CSDL framework is a continuous cycle. The Manage and Respond phase explicitly involves "Ongoing Security Testing and Assessment" and responding to new vulnerabilities, which necessitates re-evaluating and updating the existing threat model to address new risks. The lifecycle nature of the framework demonstrates that security is not a one-time event.

Reference: Cisco Trust Center, "Cisco Secure Development Lifecycle (CSDL)". The process diagram and phase descriptions illustrate security touchpoints throughout the entire lifecycle, not just at the start.

2. National Institute of Standards and Technology (NIST), Special Publication (SP) 800-218, "Secure Software Development Framework (SSDF) Version 1.1: Recommendations for Mitigating the Risk of Software Vulnerabilities".

Reference: Section 3.2, Practice Design Software Securely (DS), Task DS.3 states: "Threat model the software to identify and address design-level security risks. This should be performed on an ongoing basis during development and updated as the software design changes." This directly contradicts the idea that threat modeling is only for the initial phase.

3. Carnegie Mellon University, Software Engineering Institute (SEI), "Threat Modeling: 12 Available Methods" by Allen, C., & Horkau, J. (2018).

Reference: In the section "When Should You Threat Model?", the authors state, "Threat modeling is not a one-time activity. It should be performed throughout the entire development lifecycle... As the system evolves, so will its attack surface. The threat model should be updated to reflect these changes." This university-affiliated research center explicitly defines threat modeling as a continuous, lifecycle-spanning activity.

4. Shostack, A. (2014). Threat Modeling: Designing for Security. John Wiley & Sons.

Reference: Chapter 3, "An Agile Approach to Threat Modeling," page 31, states, "Threat modeling is an ongoing activity, not a one-time task... You should plan to revisit and update your threat models as your system evolves." This foundational academic and professional text emphasizes the iterative nature of the process.