threat-modeling
Threat Modeling
Overview
Threat modeling is a structured approach to identifying, quantifying, and addressing the security risks associated with a system. As Adam Shostack describes in Threat Modeling: Designing for Security (2014), the goal is to answer four fundamental questions: (1) What are we building? (2) What can go wrong? (3) What are we going to do about it? (4) Did we do a good job? By systematically analyzing a system's architecture through data flow diagrams and applying frameworks such as STRIDE for threat identification and DREAD for risk assessment, teams can discover and mitigate security weaknesses before they become vulnerabilities in production. Threat modeling is most effective when integrated early in the software development lifecycle and revisited as the system evolves.
STRIDE Framework
STRIDE is a mnemonic developed at Microsoft for classifying security threats. Each letter represents a category of threat that violates a corresponding security property.
| Threat | Property Violated | Description | Example | Mitigation Strategy |
|---|---|---|---|---|
| Spoofing | Authentication | An attacker pretends to be someone or something else to gain unauthorized access. | Forged authentication token used to impersonate a legitimate user. | Strong authentication (MFA, OAuth 2.0, certificate-based auth); validate identity at every trust boundary. |
| Tampering | Integrity | Unauthorized modification of data in transit or at rest. | Man-in-the-middle attack alters API request payload between client and server. | TLS for data in transit; digital signatures; checksums; write-access controls; tamper-evident logging. |
| Repudiation | Non-repudiation | An attacker performs an action and then denies having done it, with no way to prove otherwise. | User deletes records and claims they never accessed the system. | Audit logging with tamper-proof storage; digital signatures on transactions; centralized SIEM with log integrity. |
| Information Disclosure | Confidentiality | Sensitive information is exposed to unauthorized parties. | Database connection string leaked in a verbose error message returned to the client. | Encrypt sensitive data; enforce access controls; suppress detailed error messages in production; classify data by sensitivity. |
| Denial of Service | Availability | An attacker makes a system or resource unavailable to legitimate users. | Flood of API requests overwhelms a service with no rate limiting. | Rate limiting; auto-scaling; circuit breakers; input size validation; CDN and DDoS protection services. |
| Elevation of Privilege | Authorization | An attacker gains elevated access rights beyond what they are authorized to have. | Exploiting a local file inclusion vulnerability to execute code as root. | Least privilege; run processes with minimum required permissions; input validation; sandboxing; regular privilege audits. |