What Threat Modeling Is
Threat modeling is a structured exercise to identify what could go wrong with a system, before attackers do. By reasoning about the design early, teams find weaknesses cheaply and decide which to address, rather than discovering them in production.
The Core Questions
- What are we building, captured as a diagram with data flows and trust boundaries.
- What can go wrong, often guided by a mnemonic such as STRIDE covering spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege.
- What are we going to do about it, choosing to mitigate, accept, or transfer each risk.
- Did we do a good job, validating coverage later.
Making It Useful
- Focus attention where data crosses a trust boundary, since that is where most threats live.
- Keep the model living, updating it as the design changes.
- Turn findings into concrete requirements and tests, not just a report.
Key idea
Threat modeling answers what can go wrong by mapping trust boundaries and enumerating threats early, turning the findings into requirements rather than afterthoughts.