Threat Modeling Expert

Expert in threat modeling methodologies, security architecture review, and risk assessment using STRIDE, PASTA, attack trees, and security requirement extraction.

Description

USE WHEN:

• Designing new systems or features (secure-by-design)
• Reviewing architecture for security gaps
• Preparing for security audits
• Identifying attack vectors and threat actors
• Prioritizing security investments
• Creating security documentation
• Training teams on security thinking

DON'T USE WHEN:

• Lack scope or authorization for security review
• Need legal compliance certification (consult legal)
• Only need automated scanning (use vulnerability-scanner)

---

Core Process

1. Define Scope

• System boundaries
• Assets to protect
• Trust boundaries
• Regulatory requirements

2. Create Data Flow Diagram

[User] → [Web App] → [API Gateway] → [Backend] → [Database]
                ↓
          [External API]

3. Identify Assets & Entry Points

• Assets: User data, credentials, business logic, infrastructure
• Entry Points: APIs, forms, file uploads, admin panels

4. Apply STRIDE

• Spoofing: Can someone impersonate?
• Tampering: Can data be modified?
• Repudiation: Can actions be denied?
• Information Disclosure: Can data leak?
• Denial of Service: Can availability be affected?
• Elevation of Privilege: Can access be escalated?

5. Build Attack Trees

Goal: Access Admin Panel
├── Steal admin credentials
│   ├── Phishing
│   ├── Brute force
│   └── Session hijacking
├── Exploit vulnerability
│   ├── SQL injection
│   └── Auth bypass
└── Social engineering
    └── Support desk compromise

6. Score & Prioritize

Use DREAD or CVSS:

• Damage potential
• Reproducibility
• Exploitability
• Affected users
• Discoverability

7. Design Mitigations

Map threats to controls and validate coverage.

8. Document Residual Risks

What's accepted vs. mitigated.

---

STRIDE Analysis Template

| Component | Spoofing | Tampering | Repudiation | Info Disclosure | DoS | EoP | |-----------|----------|-----------|-------------|-----------------|-----|-----| | Web App | Auth bypass | XSS, CSRF | Missing logs | Error messages | Rate limit | Broken access | | API | Token theft | Input manip | No audit | Data exposure | Resource exhaust | Privilege escalation | | Database | Credential theft | SQL injection | No audit trail | Backup exposure | Connection flood | Direct access |

---

Threat Categories by Layer

Application Layer

• Injection (SQL, XSS, command)
• Broken authentication
• Sensitive data exposure
• Broken access control
• Security misconfiguration
• Using vulnerable components

Network Layer

• Man-in-the-middle
• Eavesdropping
• Replay attacks
• DNS spoofing
• DDoS

Infrastructure Layer

• Unauthorized access
• Misconfigured services
• Unpatched systems
• Weak credentials
• Exposed admin interfaces

Human Layer

• Phishing
• Social engineering
• Insider threats
• Credential sharing

---

Data Flow Diagram Elements

| Element | Symbol | Description | |---------|--------|-------------| | External Entity | Rectangle | Users, external systems | | Process | Circle | Application logic | | Data Store | Parallel lines | Database, cache, files | | Data Flow | Arrow | Data movement | | Trust Boundary | Dashed line | Security perimeter |

---

Risk Prioritization Matrix

              LOW IMPACT    HIGH IMPACT
HIGH LIKELIHOOD   MEDIUM        HIGH
LOW LIKELIHOOD    LOW           MEDIUM

DREAD Scoring (1-10 each)

| Factor | Question | |--------|----------| | Damage | How bad if exploited? | | Reproducibility | How easy to reproduce? | | Exploitability | How easy to attack? | | Affected Users | How many impacted? | | Discoverability | How easy to find? |

Score: Sum / 5 = Risk Level

---

Mitigation Strategies

Input Validation

• Whitelist validation
• Parameterized queries
• Output encoding
• Content-Type enforcement

Authentication

• MFA where possible
• Strong password policies
• Account lockout
• Secure session management

Authorization

• Principle of least privilege
• Role-based access control
• Resource ownership checks
• Regular permission audits

Cryptography

• TLS 1.2+ everywhere
• Strong key management
• Secure password hashing
• Encrypted data at rest

Monitoring

• Security event logging
• Anomaly detection
• Alert thresholds
• Incident response plan

---

Best Practices

1. Involve developers in threat modeling sessions
2. Focus on data flows, not just components
3. Consider insider threats
4. Update models with architecture changes
5. Link threats to security requirements
6. Track mitigations to implementation
7. Review regularly, not just at design time
8. Keep models living documents

---

Output Template

# Threat Model: [System Name]

## Scope
- Components in scope
- Out of scope

## Assets
- Critical assets list

## Trust Boundaries
- Internal vs external
- Admin vs user

## Data Flow Diagram
[DFD here]

## STRIDE Analysis
[Table here]

## Prioritized Threats
1. [High] Description - Mitigation
2. [Medium] Description - Mitigation

## Residual Risks
- Accepted risks with justification

## Review Schedule
- Next review date