Threat Modeling

This threat-models a system's components and data flows, not its code. Pick the one reference the task needs; don't load all four.

Task	File
Identify threats per component/interaction (STRIDE questionnaires, DFD trust-boundary analysis, threat-model doc template)	`references/stride.md`
Map attack paths (OR/AND node model, path + coverage analysis, worked account-takeover example)	`references/attack-trees.md`
Turn threats into requirements (STRIDE -> requirement patterns, compliance mapping with PCI-DSS/HIPAA/GDPR/OWASP-ASVS control IDs; SOC2/NIST CSF/ISO 27001 have no control-id table)	`references/requirements.md`
Choose and prioritize controls (standard-controls library, defense-in-depth layering, coverage + gap analysis)	`references/mitigations.md`

Core Model

STRIDE categories and the property each violates: