Threat modeling

Done at design time this is cheap and changes the design. Done after launch it produces a list of things that are expensive to fix, so the timing is most of the value.

Four questions, in order

1. What are we building? A diagram of the actual data flow — not the org chart, not the marketing architecture. Components, the data moving between them, and where each store lives. If nobody can draw it, that is the first finding.

Mark the trust boundaries: every point where data crosses from something you control to something you do not, or from one privilege level to another. Almost every real vulnerability lives on a boundary.

2. What can go wrong? Walk each boundary and each asset. A usable prompt set: