threat-modeling

Threat Modeling

Identify, prioritize, and mitigate security threats systematically using STRIDE methodology

Level 1: Quick Reference

STRIDE Threat Categories

threats:
  S_spoofing:
    description: Impersonating something or someone else
    targets: [authentication, identity]
    example: "Using stolen credentials to access system"

  T_tampering:
    description: Modifying data or code maliciously
    targets: [data_integrity, code_integrity]
    example: "Altering transaction amounts in transit"

  R_repudiation:
    description: Claiming to not have performed an action
    targets: [logging, audit_trails]
    example: "Denying fraudulent transaction was performed"

  I_information_disclosure:
    description: Exposing information to unauthorized parties
    targets: [confidentiality, data_protection]
    example: "Leaking customer PII through error messages"

  D_denial_of_service:
    description: Making system unavailable or degraded
    targets: [availability, performance]
    example: "Overwhelming API with requests"

  E_elevation_of_privilege:
    description: Gaining unauthorized higher access level
    targets: [authorization, access_control]
    example: "Exploiting bug to gain admin rights"

Four Key Questions

1. What are we building?

   • System architecture, components, data flows
   • Trust boundaries, entry/exit points

2. What can go wrong?

   • Apply STRIDE to each component
   • Identify threat scenarios

3. What should we do about it?

   • Prioritize threats (DREAD scoring)
   • Design mitigations

4. Did we do a good job?

   • Review threat model coverage
   • Validate mitigations

Essential Checklist

Planning Phase:

• Identify system scope and boundaries
• Document assets and data flows
• Define security objectives
• Assemble threat modeling team

Analysis Phase:

• Create data flow diagrams (DFD)
• Mark trust boundaries
• Apply STRIDE to each element
• Document threat scenarios
• Build attack trees