threat-modeling

Threat Modeling

Adversarial design-time analysis: enumerate threats against a system and specify mitigations. This skill routes to methodology files, workflow runbooks, example libraries, and control-catalog references. Extended adversarial reasoning is the core value — spend thinking budget on threat enumeration.

When to Use

• New system or major architecture change needs security review.
• An OpenAPI / AsyncAPI spec exists and you want automatic STRIDE-per-interaction.
• Architecture docs or diagrams need threat analysis.
• A specific high-impact threat requires attack-tree deep dive.
• Privacy / personal-data handling needs threat analysis (LINDDUN).
• Mitigations need mapping to NIST CSF / NIST 800-53 / CIS / OWASP ASVS.
• Producing a threat model report for stakeholders / auditors.
• Prioritizing existing threat lists by risk score.

Trigger Phrases

• "threat model this application / service / API"
• "identify threats using STRIDE / PASTA / LINDDUN"
• "create a data flow diagram / DFD"
• "analyze the attack surface"
• "build an attack tree for X"
• "map these threats to NIST / ASVS / CIS controls"

When NOT to Use This Skill

• Runtime API testing / exploitation of a live endpoint → use testing-apis (this skill identifies threats; testing-apis confirms exploitability).
• Code-level vulnerability discovery in a repo (SAST/DAST/SCA) → use auditing-code-for-vulnerabilities.
• Container image CVE scanning → use container-security.
• Cloud posture misconfigurations → use iac-security / cloud-security skill.
• Incident response on an active intrusion → this is design-time; use IR playbooks instead.
• Compliance gap analysis only (no threat enumeration) → use a compliance skill; thread results back here for design changes.

Decision Tree

1. Have an OpenAPI / AsyncAPI spec?
   → workflows/stride_from_openapi.md         (highest-leverage entry point)

2. Have architecture docs or diagrams (or diagram images)?
   → workflows/stride_from_arch_docs.md
     (if diagrams only, first workflows/dfd_creation.md)

3. Need a DFD from scratch?
   → workflows/dfd_creation.md  (emit Mermaid)

4. Already have a high-level threat; need deep path analysis?
   → workflows/attack_tree_from_threat.md

5. Have threats; need mitigations + catalog mappings?
   → workflows/threat_to_mitigation.md

6. Privacy-specific modeling?
   → methodology/linddun.md

7. Enterprise-wide risk?
   → methodology/octave.md

8. Unsure which methodology?
   → references/framework_comparison.md