Skip to content

Threat Modeling

Systematic identification of threats before they're exploited is more effective than reactive security; thinking like an attacker reveals vulnerabilities that defenders miss.

Tension Addressed

Defense Depth vs. Complexity

Recognizable As

Data flow diagrams with trust boundaries; STRIDE analysis; attack trees; security review as part of design; "what could go wrong" sessions; penetration testing as threat model validation.

Canonical Sources

Shostack, "Threat Modeling: Designing for Security" (2014); Microsoft STRIDE methodology

Transfers To

Risk management (identifying risks before they materialize), safety engineering (failure mode analysis), business strategy (competitive threat analysis), insurance (actuarial analysis)

Sub-concepts: - STRIDE categories: Spoofing (impersonation), Tampering (modification), Repudiation (deniability), Information disclosure (confidentiality breach), Denial of service (availability), Elevation of privilege (authorization bypass) - Attack surface: The sum of all points where an attacker can attempt to enter or extract data; smaller surfaces are easier to defend - Risk = Likelihood x Impact: Not all threats need equal attention; prioritize by probability and consequences