Threat Modeling (PLAN phase)

Overview

Decide what to worry about and test first before spending effort. Map assets, entry points, and trust boundaries; apply STRIDE; rank risks by likelihood × impact.

Core principle: You can't test everything. Spend effort where a break hurts most.

Process

1. Inventory assets — What's valuable? (user data, money, credentials, PII, admin control, IP)
2. Map entry points — Every place untrusted input enters: routes/endpoints, forms, file uploads, query params, headers, webhooks, message queues, mobile API calls, third-party callbacks.
3. Draw trust boundaries — Where does data cross from less-trusted to more-trusted? (browser→API, API→DB, service→service, user→admin). Bugs cluster on these lines.
4. Apply STRIDE per boundary/component — see references/stride-and-surface.md.
5. Rank — score each threat: risk = likelihood × impact (1–3 each → 1–9). Test high scores first.