threat-modeler

Threat Modeler (STRIDE)

Overview

Keywords: STRIDE, threat model, threat modeling, data flow diagram, DFD, trust boundary, attack surface, spoofing, tampering, repudiation, information disclosure, denial of service, elevation of privilege, DREAD, risk rating, mitigation, countermeasure, security review, attacker, asset.

This skill drives a rigorous, repeatable threat-modeling session using the STRIDE methodology popularized by Microsoft's Security Development Lifecycle. It turns an architecture description into:

1. A data flow diagram (DFD) with trust boundaries.
2. A per-element threat enumeration mapped to the six STRIDE categories.
3. A prioritized mitigation plan with risk ratings and concrete countermeasures.

The output is a single threat model document. Threat modeling answers four questions (the Shostack frame): What are we building? What can go wrong? What are we going to do about it? Did we do a good enough job?

Bundled resources:

• references/stride-catalog.md — STRIDE definitions, the element-to-threat applicability matrix, attacker archetypes, and a large catalog of concrete threats and standard mitigations per category.
• references/risk-rating.md — DREAD and Likelihood×Impact rating rubrics with scoring tables and prioritization guidance.
• scripts/threat_report.py — stdlib-only Python tool that ingests a YAML/JSON threat list and emits a sorted Markdown risk register plus summary stats.
• templates/threat-model.md — the fill-in document the skill produces.
• examples/url-shortener.md — a complete worked example (input architecture → DFD → threats → mitigations).

Workflow

Follow these steps in order. Do not skip decomposition — most missed threats come from a sloppy DFD.

1. Scope and gather context

Establish what is in and out of scope. Capture:

• Assets: what an attacker wants (credentials, PII, money, availability, integrity of records).
• System purpose and the primary user journeys.
• Tech stack, deployment model, and external dependencies (third-party APIs, SaaS, queues, databases).
• Existing controls already in place (auth, TLS, WAF, RBAC).