Threat Modeling

Purpose

Find the security problems in a design before they are built. Threat modeling is cheap; the same finding after launch is a rewrite, and after a breach it is a disclosure.

When to Use

• Designing a new system or a significant feature.
• Adding a new trust boundary: a new integration, a new user role, a new data flow.
• Before a security review or a compliance audit.
• After an incident, to find the siblings of what just happened.

Capabilities

• Data-flow modeling and trust-boundary identification.
• STRIDE analysis: spoofing, tampering, repudiation, information disclosure, denial of service, elevation of privilege.
• Risk ranking by likelihood and impact.
• Mitigation design and acceptance of residual risk.