1. Core Idea
Threat Modeling in One Line
Threat modeling is a structured way to understand your system,
identify how it can be attacked, and
prioritize mitigations that protect what matters most.
“My approach is: define scope, map trust boundaries, identify threats using STRIDE/attack trees,
prioritize using risk scoring, and propose actionable mitigations aligned with the SDLC.”
2. Core Steps & Frameworks
Core Steps
- Define scope: components, data flows, trust boundaries, assumptions.
- Identify assets: sensitive data, credentials, APIs, business functions.
- Map threat actors: external attackers, insiders, bots, supply‑chain.
- Analyze attack surface: entry points, APIs, cloud services, secrets.
- Identify threats: STRIDE, OWASP Top 10, CAPEC, cloud misconfigurations.
- Assess risk: likelihood × impact (simple H/M/L is fine).
- Recommend mitigations: map threats to controls.
- Integrate with SDLC: design reviews, sprint planning, CI/CD.
- Continuously update: new features, integrations, vulnerabilities.
Key Frameworks
- STRIDE: Spoofing, Tampering, Repudiation, Info Disclosure, DoS, Privilege Escalation.
- PASTA: 7‑stage attacker‑centric methodology.
- Attack Trees: attacker goal → sub‑goals → steps.
- DREAD: risk scoring model.
- OWASP Top 10: common web/API risks.
Being fluent in STRIDE + OWASP Top 10 is enough for most real‑world scenarios.
3. Trust Boundaries (General & Cloud)
| Trust Boundary |
Description |
Mitigations |
| User → Application |
Untrusted user input enters the system. |
Validation, sanitization, rate limiting. |
| Client → Server |
Data travels from user device to backend. |
TLS, secure cookies, CSRF protection. |
| Web Tier → API Tier |
Frontend calling backend APIs. |
OAuth, RBAC, schema validation. |
| Application → Database |
App sends queries to DB. |
Parameterized queries, least privilege. |
| Service → Service |
Microservices communicating internally. |
mTLS, IAM roles, token validation. |
| Third‑Party Integrations |
External SaaS or vendor APIs. |
Scoped tokens, monitoring, sandboxing. |
| Cloud Boundary |
Description |
Mitigations |
| VPC Boundary |
Logical isolation of cloud network. |
NACLs, SGs, routing rules. |
| Public Subnet |
Internet‑facing components (ALB, NAT). |
WAF, SG allow‑lists, no DBs here. |
| Private Subnet |
Internal workloads (EC2, DB, ECS). |
No internet route, least privilege SGs. |
| Cloud Account → Cloud Service |
IAM roles accessing cloud services. |
Least privilege IAM, key rotation. |
| On‑Prem → Cloud |
Hybrid connectivity. |
VPN, encryption, segmentation. |
| Internet → Edge |
Traffic entering ALB/API Gateway. |
WAF, rate limiting, DDoS protection. |
Tip: When analyzing a system, mark trust boundaries first — they reveal the highest‑value threats.
4. Threat Categories (STRIDE)
STRIDE Examples
- Spoofing: fake identity, stolen tokens.
- Tampering: data manipulation, insecure APIs.
- Repudiation: missing logs, unverifiable actions.
- Information Disclosure: data leaks, misconfigurations.
- Denial of Service: resource exhaustion, API abuse.
- Privilege Escalation: broken access control.
Mitigation Themes
- Authentication: MFA, secure sessions.
- Authorization: RBAC/ABAC, least privilege.
- Input handling: validation, encoding.
- Encryption: TLS, at‑rest encryption.
- Logging & monitoring: structured logs, alerts.
- Rate limiting: protect APIs.
- Secure defaults: hardened configs.
5 & 6. Risk, Prioritization & Additional Considerations
| Risk & Prioritization |
Details |
| Likelihood |
Ease of exploitation, attacker skill, existing controls. |
| Impact |
Data sensitivity, business impact, downtime, regulatory exposure. |
| Scoring |
Simple High / Medium / Low scoring works effectively. |
| Prioritization |
Focus on threats with both high likelihood and high impact. |
| Decision Making |
Choose mitigation, transfer, acceptance, or avoidance. |
| Additional Considerations |
Details |
| Abuse Cases |
Consider how legitimate features can be misused or weaponized. |
| Supply-Chain Risk |
Dependencies, CI/CD pipelines, third-party libraries, vendor services. |
| Data Lifecycle |
Collection → storage → processing → sharing → deletion. |
| Privacy & Compliance |
GDPR, PCI, HIPAA, data residency, retention policies. |
| Resilience |
Backups, DR strategy, incident response readiness. |
These two areas help ensure threat modeling remains practical, risk‑driven, and aligned with real‑world system behavior.