threat-modeling

Threat Modeling Skill — Cybersecurity Engineer

Overview

This skill provides comprehensive guidance for threat modeling and security analysis. It covers threat identification, attack vector analysis, threat model creation, and threat mitigation following CISSP and CSSLP certifications and OWASP threat modeling standards.

When to Use

Use this skill when:

• Performing threat modeling for systems
• Identifying security threats and vulnerabilities
• Analyzing attack vectors and attack paths
• Creating threat models for applications
• Implementing STRIDE threat modeling
• Using DREAD risk assessment
• Creating attack trees
• Performing threat modeling workshops
• Identifying security requirements
• Creating threat mitigation strategies
• Documenting threat models
• Performing threat modeling for APIs
• Creating threat models for microservices
• Performing threat modeling for cloud systems
• Identifying insider threats
• Analyzing supply chain threats
• Creating security requirements
• Performing threat modeling for mobile apps
• Identifying data flow threats
• Creating threat models for IoT systems
• Performing threat modeling for web applications
• Identifying authentication threats
• Analyzing authorization threats
• Creating threat models for databases

Do NOT use this skill when:

• Writing application business logic (use domain-driven skill)
• Designing database schemas (use database-design skill)
• Writing API endpoint specifications (use api-design skill)
• Performing general code review (use code-review skill)
• Writing SQL queries (use sql-best-practices skill)
• Designing multi-page website layouts (use design-system skill)
• Analyzing deployment configurations (use deployment skill)
• Writing documentation (use documentation-best-practices skill)

Threat Modeling Frameworks

STRIDE Model

┌─────────────────────────────────────────────────────────────┐
│              STRIDE Threat Modeling                         │
├─────────────────────────────────────────────────────────────┤
│  S - Spoofing Identity:                                     │
│  - Impersonating users or systems                           │
│  - Attack examples: Credential theft, token theft           │
│  - Mitigations: Authentication, MFA, certificates           │
│                                                              │
│  T - Tampering with Data:                                   │
│  - Modifying data in transit or at rest                     │
│  - Attack examples: Data manipulation, code injection       │
│  - Mitigations: Integrity checks, digital signatures        │
│                                                              │
│  R - Repudiation:                                           │
│  - Actions cannot be traced to actor                        │
│  - Attack examples: Denying actions, log tampering          │
│  - Mitigations: Audit logging, non-repudiation              │
│                                                              │
│  I - Information Disclosure:                                │
│  - Unauthorized access to information                       │
│  - Attack examples: Data breaches, eavesdropping            │
│  - Mitigations: Encryption, access controls                 │
│                                                              │
│  D - Denial of Service:                                     │
│  - Service unavailable to legitimate users                  │
│  - Attack examples: DDoS, resource exhaustion               │
│  - Mitigations: Rate limiting, redundancy                   │
│                                                              │
│  E - Elevation of Privilege:                                │
│  - Gaining higher privileges than intended                  │
│  - Attack examples: Privilege escalation, code execution    │
│  - Mitigations: Least privilege, access controls            │
└─────────────────────────────────────────────────────────────┘