Threat Modeling

Threat Modeling

Answer four questions: What are we building? What can go wrong? What do we do about it? Did we do a good job? Do it early — design-time fixes are far cheaper than post-incident ones.

1. Model the system

Sketch the data flow: external entities, processes, data stores, and the flows between them. Mark trust boundaries — every point where data crosses from less-trusted to more-trusted (internet → server, user → admin, service → database). Threats cluster at boundaries.

2. Enumerate threats — STRIDE

For each element and flow, ask which apply:

| Threat | Property violated | Example | |--------|-------------------|---------| | Spoofing | Authentication | forging a user's identity, stolen token | | Tampering | Integrity | modifying data in transit or at rest | | Repudiation | Non-repudiation | denying an action; no audit trail | | Information disclosure | Confidentiality | leaking PII, secrets in logs | | Denial of service | Availability | resource exhaustion, unbounded work | | Elevation of privilege | Authorization | user gains admin, IDOR, missing authz |

Walk untrusted input from each entry point to every sink it can reach.

3. Decide on controls

For each credible threat, choose: mitigate (add a control), eliminate (remove the feature/data), transfer (offload to a vetted provider), or accept (document the residual risk and why). Map threats to concrete defenses:

• Spoofing → strong authN, MFA, signed/short-lived tokens.
• Tampering → TLS, integrity checks, server-side validation, least privilege.
• Repudiation → audit logging of security-relevant actions.
• Disclosure → encryption in transit/at rest, minimize data, scrub logs.
• DoS → rate limits, timeouts, quotas, bounded input sizes.
• EoP → authorize every action, default-deny, separation of duties.

4. Validate

Did each high-severity threat get a control? Are controls testable? Add tests/alerts for the important ones. Re-model when the design changes materially.

Prioritize

Risk = likelihood × impact. Fix the exposed, high-impact, easy-to-exploit issues first. Don't drown the design in low-severity theoreticals — focus on what an attacker would actually reach and abuse.

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: AlisinaDevelo
• Source: AlisinaDevelo/md-files
• License: MIT

Install and usage instructions live in the source repository linked above.