Threat modeling systems and related methods including compensating controls

A threat modeling system, comprising:

• a computing device communicatively coupled with a database, the computing device displaying, on a display of the computing device:
• one or more input interfaces configured to, in response to receiving one or more user inputs, store a plurality of user-defined threat model components in the database, store a plurality of threats in the database, associate each of the threats with at least one of the threat model components through the database, store a plurality of security requirements in the database including an indication for each security requirement indicating whether it comprises a compensating control, and associate each compensating control with at least one of the threats through the database;
• a diagram interface configured to, in response to receiving one or more user inputs, diagram a computing network, using visual representations of the threat model components stored in the database, to define a threat model;
• a threat report displaying each threat that is associated through the database with one of the threat model components included in the threat model, wherein the threat report displays a threat status for each threat indicating whether that threat has been mitigated, and wherein the threat report comprises one or more input fields configured to, in response to receiving one or more user inputs, manually change the threat status of a selected threat;
• and;
• a compensating control report displaying each compensating control that is associated through the database with one of the threats included in the threat report;
• wherein the one or more input interfaces are configured to, in response to receiving one or more user inputs, remove one of the compensating controls from the diagram interface and automatically change the threat status of at least one of the threats included in the threat report to an unmitigated status, and;
• wherein the threat modeling system improves security of an actual computing network, modeled by the diagrammed computer network, by allowing a user to assess effectiveness of mitigations of actual threats of the actual computing network without penetration testing of the actual computing network, the actual threats corresponding with the threats included in the threat report.

A threat modeling and threat mitigating system, comprising:

• a computing device communicatively coupled with a database, the computing device displaying, on a display of the computing device:
• one or more input interfaces configured to, in response to receiving one or more user inputs, store a plurality of user-defined threat model components in the database, store a plurality of threats in the database, associate each of the threats with at least one of the threat model components through the database, store a plurality of security requirements in the database including an indication for each security requirement indicating whether it comprises a compensating control, and associate each compensating control with at least one of the threats through the database;
• a diagram interface configured to, in response to receiving one or more user inputs, diagram a computing network, using visual representations of the threat model components stored in the database, to define a threat model;
• a threat report displaying each threat that is associated through the database with one of the threat model components included in the threat model, wherein the threat report displays a threat status for each threat indicating whether that threat has been mitigated, and wherein the threat report comprises one or more input fields configured to, in response to receiving one or more user inputs, manually change the threat status of a selected threat;
• a compensating control report displaying:
• each compensating control that is associated through the database with one of the threats included in the threat report, wherein each threat in the threat report that is associated with one of the compensating controls comprises a mitigatable threat;
• each mitigatable threat, and;
• the threat status for each mitigatable threat indicating whether it has been mitigated;
• a mitigations interface displaying all threats included in the threat report that are associated through the database with a selected compensating control, the mitigations interface identifying which of the displayed threats are mitigatable by the selected compensating control, the mitigations interface comprising one or more input fields configured to, in response to receiving one or more user inputs, change the threat status of all threats mitigatable by the selected compensating control to a mitigated status, and;
• a tangible computing network matching the diagrammed computing network, the tangible computing network mitigating actual threats corresponding with the threats displayed in the threat report;
• wherein the one or more input interfaces are configured to, in response to receiving one or more user inputs, remove one of the compensating controls from the diagram interface and automatically change the threat status of at least one of the threats included in the threat report to an unmitigated status.