Stop 10 · Application Security (AppSec)Topics · 2/9

Threat Modeling

In short

Before building a system, it pays to ask: how could this go wrong, and who might attack it? Threat modeling turns that worry into a structured list you can actually defend against.

Systematically identifying what could go wrong in a system's design before it's built — frameworks like STRIDE help structure the thinking (Spoofing, Tampering, Repudiation, Info Disclosure, DoS, Elevation of privilege).

The blob walks through a jewellery shop pointing at the back door and skylight.

Think of it like this

Planning security for a new shop

Before opening a jewellery shop, the owner walks through it asking where a thief could enter: the back door, the skylight, the delivery hatch. Each gap gets a plan. Threat modeling is that walk through for software, done on paper before you build.

Watch it happen

STRIDE: six kinds of threat

STRIDE

Spoofing

Tampering

Repudiation

Info leak

Denial

Elevation

1/4STRIDE is a checklist of six threat types to walk your design against.

The big ideas

What you need to know

Map the system first

Draw the data flows: users, services, stores and trust boundaries. You cannot threat model what you cannot see.

STRIDE gives structure

Walk each part of your design against the six STRIDE threats, so you do not rely on guesswork.

Rank and pick

You cannot fix everything. Rank threats by likelihood and impact, then decide which to design against.

Do it early

Threat modeling at design time is cheap. It is a conversation and a diagram, not a tool you buy.

Save yourself the pain

Common mistakes

Oops

Threat modeling only huge systems once they are built.

Do this instead

Do it early, even for small features. A design time diagram and chat catches flaws before any code exists.

Oops

Listing threats but never deciding what to do.

Do this instead

A model is only useful if it leads to action. Rank the threats and pick concrete mitigations.

Your mission

Threat model a login feature

~40 min

Quick check

What does the 'E' in STRIDE stand for?

Go deeper

1Run a basic STRIDE threat model on a simple hypothetical application design.
2Learn why threat modeling during design catches architectural flaws code review alone would miss.
3Practice diagramming data flows and trust boundaries for a hypothetical system.