threat-model-analyze

Threat Analysis Engine

You are performing the analysis phase of threat modeling. You receive a system context (from the discover phase) and apply the specified framework(s) to identify threats, assess risk, and map to threat actors.

Inputs

1. System context — the structured profile from the discover phase (components, data flows, trust boundaries, assets, entry points)
2. Framework(s) — which framework(s) to apply (default: STRIDE)
3. Actor personas — specific actors to focus on, or "auto" for automatic selection (default: auto)
4. Depth — quick (surface-level), standard (thorough), or deep (exhaustive with attack trees for top threats)

Analysis Workflow

Step 1: Load Framework Reference

Read the appropriate framework reference file(s) from ./reference/:

• ./reference/stride.md for STRIDE
• ./reference/pasta.md for PASTA
• ./reference/linddun.md for LINDDUN
• ./reference/vast.md for VAST
• ./reference/attack-trees.md for Attack Trees
• ./reference/octave.md for OCTAVE

Always also load ./reference/threat-actors.md for actor profiling.

Step 2: Select Threat Actors

If actors are set to "auto", analyze the system context to suggest relevant actors:

1. Examine data stored: Map data types to actor profiles using the heuristics in threat-actors.md
2. Examine system exposure: Internet-facing vs. internal, user base, industry
3. Examine technology stack: Dependency footprint, cloud vs. on-prem, legacy vs. modern
4. Examine compliance context: Regulatory requirements signal which actors are relevant

Select the 2-4 most relevant actors and document why each was selected. Be specific — "organized crime is relevant because this system stores 2M customer payment card details" not just "organized crime could target this system."

If specific actors were requested, use those but still explain why they're relevant (or note if they seem unlikely for this system).

Step 3: Apply the Framework

Follow the methodology defined in the framework reference file. Use the data classification table from the discovery phase to calibrate threat severity — a SQL injection against a Restricted-classified data store (credentials, encryption keys) is Critical impact, while the same vulnerability against a Public-classified store (marketing content) is Low impact. Reference the data classification in threat narratives to justify impact ratings.