Threat Modeling

Threat modeling is the structured practice of analyzing representations of a system to highlight security and privacy concerns. It is a planned activity that identifies threats and defines countermeasures, applied to software, systems, networks, distributed systems, IoT devices, and business processes. A threat model is a structured representation of all the information that affects the security of a subject, viewed through the lens of security.

Threat modeling is best applied continuously throughout a project, not as a single deliverable. The process is essentially the same at different levels of abstraction, while the information grows more granular through the lifecycle. A high-level model early in concept or planning is refined as the design gains detail, because each new choice — a technology, an interface, an implementation pattern — can introduce new threats.

The four-question framework

The practice is organized around four questions:

1. What are we working on? Scope the work. Draw it, often as a data flow diagram. Identify entry points, assets, and trust boundaries.
2. What can go wrong? Identify threats. Use a structured method to keep the search thorough without evaluating every possible combination.
3. What are we going to do about it? Identify countermeasures or manage risk. Choose to mitigate, accept, transfer, or eliminate.
4. Did we do a good enough job? Assess the work. Confirm there is a diagram, a threats list, and a controls list, and that the model remains accurate.

There is no single "right" way to evaluate the search space of possible threats, but structured models make the process more efficient and reproducible. Attempting to evaluate all combinations of threat agent, attack, vulnerability, and impact is usually wasted effort.