Threat Modeling
Threat modeling is the structured practice of analyzing a system's design to find security and privacy concerns before and during development. It answers four questions: what is being built, what can go wrong, what to do about it, and whether the work was good enough.
itCybersecurity fundamentals and governance | OpenSkills.info
Course pathWalk it in order
Look it upDip in anytime
Go furtherLeaves this page
Don't Panic
Don't Panic: Threat Modeling
Threat modeling is the habit of looking at a system design before reality begins throwing objects at it. It does not predict every vulnerability. It makes the useful admission that systems have edges, data crosses those edges, and some crossings deserve more attention than a hopeful shrug.
Start with the least magical question: what are we working on? A data flow diagram draws the external entities, processes, data stores, and arrows that move data between them. Then mark a trust boundary, which is where trust or privilege changes. The boundary is not a force field. It is a bright sign saying, "Something different is happening here. Please look." That is already much more helpful than a box labelled "the application," which has never answered a security question in its life.
Next comes what can go wrong. STRIDE is a compact set of prompts: spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege. It is not a machine that dispenses certainty. It is a way to inspect each entry point, flow, and boundary without relying on whichever alarming incident happens to be most memorable that week.
The third question is where the paperwork must become useful. For each credible threat, decide whether to accept, eliminate, mitigate, or transfer the risk. A countermeasure is the control that changes the outcome. If nobody owns it, tests it, or records an accepted residual risk, it is not yet a decision. It is a decorative promise, and systems collect those with alarming enthusiasm.
Finally, ask whether the job is good enough. Keep the diagram, threats list, and controls list aligned with the system. New features, incidents, infrastructure changes, and integrations are invitations to revisit the model. Threat modeling is not a one-time document that graduates into a quiet folder. Its value is the conversation that establishes shared understanding and gives design and code review somewhere specific to look.
Read the Intro for the full framework and vocabulary. Use Slides when the relationships need a quick map, Cheatsheet when a session needs STRIDE and countermeasure prompts, and Practice when a feature needs a repeatable process. The Landscape compares tools around the work. The Timeline explains how the practice acquired its modern shape. Field Notes covers the parts that become expensive when the diagram is mistaken for the decision.
Where this skill leads
Relevant careers
See how this topic contributes to broader role-level skill maps.
Sources
- https://www.threatmodelingmanifesto.org/
Supports
- Threat modeling as analyzing representations of a system to highlight security and privacy concerns
- The four-question framework: what are we working on, what can go wrong, what to do about it, did we do a good enough job
- Values, principles, patterns, and anti-patterns (hero threat modeler, admiration for the problem, overfocus, perfect representation)
- Dialog as key to common understanding; documents as records that enable measurement
- https://owasp.org/www-community/Threat_Modeling_Process
Supports
- The four-step structured process: scope, determine threats, determine countermeasures, assess
- DFD symbols, entry points, exit points, assets, trust levels, and trust boundaries
- STRIDE threat list with security controls and mitigation techniques
- Threat analysis with threat trees, use and abuse cases, ranking, and a qualitative risk model
- https://owasp.org/www-community/Threat_Modeling
Supports
- A threat model as a structured representation including description, assumptions, threats, actions, and validation
- Threat modeling across the lifecycle and when to update models
- The four-question framework and risk refinement of the search space
- https://cheatsheetseries.owasp.org/cheatsheets/Threat_Modeling_Cheat_Sheet.html
Supports
- Practical steps, methods, and pitfalls for running a threat modeling session
- https://attack.mitre.org/resources/
Supports
- ATT&CK as a knowledge base of observed adversary behavior for operational threat modeling
- The stated limits of group mappings and don't shout bingo guidance
- https://github.com/hysnsec/awesome-threat-modelling
Supports
- Discovery of OWASP Threat Dragon, PyTM, and the OWASP Threat Model Cookbook as ecosystem resources
- https://learn.microsoft.com/en-us/security/engineering/threat-modeling-with-dev-ops
Supports
- STRIDE's 1999 origin and modern threat-modeling guidance for DevOps
- Actionable mitigations, implementation status, and linkage from threats to controls
- The cost and quality tradeoffs of collaboration, knowledge bases, and scoped analysis
- https://www.microsoft.com/en-us/securityengineering/sdl/about
Supports
- Microsoft's SDL history from the 2003-2005 ramp-up through wider collaboration and automation
- Threat modeling as an SDL practice
- https://learn.microsoft.com/en-us/archive/msdn-magazine/2005/november/a-look-inside-the-security-development-lifecycle-at-microsoft
Supports
- Threat modeling and testing as documented elements of the Security Development Lifecycle
- https://learn.microsoft.com/en-us/previous-versions/windows/desktop/cc307406%28v%3Dmsdn.10%29
Supports
- Microsoft's 2002 Trustworthy Computing directive and security pushes including threat modeling and mitigation
- https://csrc.nist.gov/pubs/sp/800/154/ipd
Supports
- NIST's 2016 draft guidance for data-centric system threat modeling as risk assessment
- https://www.threatmodelingmanifesto.org/capabilities/
Supports
- Creation of the Threat Modeling Manifesto in 2020
- https://owasp.org/www-project-threat-dragon/docs-2/
Supports
- Threat Dragon as an open-source diagramming tool with threats and remediations
- https://github.com/OWASP/pytm
Supports
- PyTM as a model-as-code framework that generates diagrams and relevant threats
- https://learn.microsoft.com/en-us/azure/security/develop/threat-modeling-tool
Supports
- Microsoft's design-analysis threat-modeling tool and SDL approach
- https://www.iriusrisk.com/plans
Supports
- IriusRisk Community and Enterprise editions, deployment options, and subscription model
- https://www.threatmodeler.ai/products/platform/system-mapping-agent
Supports
- ThreatModeler's architecture and delivery-artifact-based system mapping