Threat modeling proactively identifies potential threats and vulnerabilities during design, before they become real-world problems.
What is Threat Modeling?
A structured process for identifying threats, prioritizing them by risk, and determining appropriate countermeasures.
Common Methodologies
- STRIDE - Categorize threats by type (Spoofing, Tampering, etc.).
- DREAD - Score threats by Damage, Reproducibility, etc.
Modeling Process
- Decompose the application into components
- Identify entry points and trust boundaries
- Enumerate potential threats
- Prioritize and plan mitigations
Threat Intelligence
Use threat data to inform modeling.