Threat Modeling Skill

Purpose

This skill ensures systematic identification, analysis, and mitigation of security threats using structured methodologies as defined in the Hack23 ISMS Threat Modeling Policy. It applies to all systems, applications, and data flows within the organization.

Rules

Threat Modeling Process

MUST:

• Perform threat modeling during design phase of all new systems and features
• Use STRIDE framework (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege)
• Map threats to MITRE ATT&CK framework techniques
• Document threat model in version control alongside architecture docs
• Review and update threat models when architecture changes
• Assign risk ratings (Critical, High, Medium, Low) to identified threats
• Define mitigation strategies for all High and Critical threats
• Track threat model findings as security requirements