Threat Modeling

Threat modeling finds security problems at design time, when they're cheapest to fix. This roadmap teaches practical methods you can use in any team. Basic knowledge of how applications and networks work is enough.

• Pick a system you know to practice on
• Get a diagramming tool
• Plan your study time

• CyberA4U Academy — courses

Start by identifying what's valuable (data, functions, reputation) and where trust changes — between users and servers, services, networks and third parties.

• List assets worth protecting
• Identify trust boundaries
• Mark entry points

Tools & tech: Secure design

• OWASP Threat Modeling Cheat Sheet

Data flow diagrams show processes, data stores, external entities and flows — the map on which threats are found.

• Draw clear DFDs
• Include trust boundaries
• Keep diagrams at the right level of detail

Tools & tech: Secure design

• OWASP Threat Dragon

STRIDE is a checklist of threat types: spoofing, tampering, repudiation, information disclosure, denial of service and elevation of privilege.

• Apply STRIDE to each element of a DFD
• Describe threats concretely
• Link threats to mitigations

Tools & tech: Secure design

• Microsoft Threat Modeling Tool — Threats (STRIDE)

Attack trees break an attacker's goal into the different ways it could be achieved, helping you see which defenses matter most.

• Build an attack tree for one goal
• Identify cheap and likely paths
• Place mitigations on the tree

Tools & tech: Secure design

• Bruce Schneier — Attack Trees

Abuse cases describe how features could be misused — "as an attacker, I want to…" — complementing normal user stories.

• Write abuse cases for features
• Turn them into security requirements
• Test them

Tools & tech: Secure design

• OWASP Abuse Case Cheat Sheet

Not every threat needs fixing now. Prioritize by likelihood, impact and cost of mitigation, and record accepted risks.

• Rate threats by risk
• Choose mitigations with the best value
• Document accepted risks

Tools & tech: Secure design

• NIST SP 800-30 Rev. 1 — Guide for Conducting Risk Assessments

The most useful threat models come from short workshops with the people who build the system. The Threat Modeling Manifesto describes good practice.

• Facilitate a short workshop
• Use the four key questions
• Capture actions in the team's backlog

Tools & tech: Secure design

• Threat Modeling Manifesto

Cloud systems add threats around identity, misconfiguration, shared responsibility and managed services.

• Include cloud identities and control plane in models
• Consider misconfiguration threats
• Use provider security guidance

Tools & tech: Secure design

• AWS Well-Architected — Security Pillar

APIs expose business logic directly. Common threats include broken object-level authorization, excessive data exposure and missing rate limits.

• Apply the OWASP API Security Top 10 to designs
• Check authorization per object and function
• Plan rate limiting

Tools & tech: Secure design

• OWASP API Security Top 10

A useful threat model is short and current: diagram, key threats, mitigations, owners and accepted risks.

• Record threats and decisions clearly
• Link findings to tickets
• Update when the design changes

Tools & tech: Secure design

• OWASP Threat Modeling Cheat Sheet

Threat modeling works best as a routine step — for new features and design changes — rather than a one-off event.

• Define when threat modeling is required
• Keep it lightweight
• Track coverage across projects

Tools & tech: Secure design

• NIST SP 800-218 — Secure Software Development Framework (SSDF)

Measure how many designs are threat-modeled, how many issues were found before release, and how quickly mitigations are delivered.

• Track threat modeling coverage
• Count design issues found early
• Track mitigation completion

Tools & tech: Secure design

• OWASP SAMM

Check that you can threat-model a system from diagram to prioritized, tracked mitigations.

• Draw DFDs with trust boundaries
• Identify threats with STRIDE and attack trees
• Prioritize and document mitigations

• CyberA4U CTF Arena — practice challenges

You can now threat-model systems. Continue with Application Security, Security Architecture or API Security Testing.

• Keep your templates
• Choose your next roadmap
• Share a sample threat model

• CyberA4U CTF Arena — practice challenges