LINDDUN Privacy Threat Modeling

Overview

LINDDUN is a systematic privacy threat modeling methodology developed by the DistriNet research group at KU Leuven. It provides a structured approach to identify and mitigate privacy threats in software systems. The acronym represents seven privacy threat categories that map to violations of privacy properties defined in ISO/IEC 29100.

The Seven LINDDUN Threat Categories

L — Linking

Definition: The ability to associate two or more data items or actions with an individual or group, beyond what is intended by the data subject.

Privacy Property Violated: Unlinkability

Threat Scenarios:

• Cross-referencing anonymized datasets to re-identify individuals
• Correlating browsing behavior across websites using fingerprinting
• Linking social media profiles to real identities through metadata
• Combining location data points to infer home/work addresses