Threat Modeling

Threat Modeling (STRIDE)

Workflow

1. Scope — Identify the system boundary, assets (PII, credentials, payments), and availability requirements (SLO/SLA). 2. Data Flow Diagram — Map actors, entry points, data stores, and external dependencies. Mark trust boundaries (public internet → edge → internal → database → third-party). 3. STRIDE per element — For each element in the diagram, walk through all six STRIDE categories (Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege) and record threats. 4. Risk score — Rate each threat by Impact (Low/Med/High) and Likelihood (Low/Med/High). Prioritize High-impact + Med/High-likelihood items first. 5. Mitigate — Convert each prioritized threat into engineering tasks, verification tasks (tests, alerts), and operational controls (runbooks, access reviews). 6. Tickets and tests — Create backlog items for mitigations and add abuse-case tests for critical flows. Add PR checklist items for ongoing verification.

Example: Threat Register Row

This single row drives three artifacts: an engineering ticket (implement revocation-list middleware), a test (verify revoked token returns 401 within TTL window), and a PR checklist item (authz checks for new endpoints).

Validation Checkpoint

Before finalizing, verify completeness:

• [ ] Every element in the data flow diagram has at least one STRIDE entry
• [ ] All High-impact threats have an assigned owner and mitigation
• [ ] Each mitigation maps to a backlog ticket or test case
• [ ] Threat model doc includes assumptions and scope boundaries
• [ ] PR checklist updated with new security requirements

Outputs (Definition of Done)

Produce a data flow diagram, a threat register, and a mitigation plan that becomes tickets and tests.

Load Next (References)

• references/stride-workshop.md — step-by-step workshop agenda + DFD guidance
• references/common-threats-and-mitigations.md — threat catalog with mitigations
• references/templates.md — copy/paste templates for docs and tickets

Common Threats and Mitigations

Authentication and Sessions

Threats:

• Credential stuffing and brute force
• Token theft and replay
• Session fixation

Mitigations:

• Rate limiting and IP/device risk checks
• Short-lived tokens + refresh rotation
• Secure cookie settings (HttpOnly, Secure, SameSite)
• MFA for privileged actions

Authorization (IDOR / Privilege Escalation)

Threats:

• Insecure direct object reference (accessing another tenant’s data)
• Missing authorization checks on internal APIs

Mitigations:

• Centralized authorization checks (policy layer)
• Tenant isolation (row-level security, scoped queries)
• Audit access to privileged endpoints

Input Handling (Injection)

Threats:

• SQL/NoSQL injection
• Command injection
• Template injection

Mitigations:

• Parameterized queries
• Strict input validation and schema enforcement
• Avoid dynamic eval/templating with untrusted input

Web Threats

Threats:

• XSS
• CSRF
• SSRF

Mitigations:

• Output encoding + CSP
• CSRF tokens and SameSite cookies
• Egress allowlists, metadata service protections, URL validation

Secrets and Key Management

Threats:

• Secrets in logs, builds, or repos
• Over-privileged keys

Mitigations:

• Secret scanning in CI
• Secret manager integration + rotation
• Least-privilege IAM and scoped credentials

Supply Chain

Threats:

• Dependency confusion / typosquatting
• Compromised build pipeline

Mitigations:

• Pin dependencies and verify integrity
• Use lockfiles and provenance (SBOM, SLSA levels where feasible)
• Restrict CI tokens and sign artifacts

Availability (DoS)

Threats:

• Resource exhaustion (CPU/memory/DB connections)
• Hot endpoints and cache misses

Mitigations:

• Rate limiting and quotas
• Timeouts, retries with backoff, circuit breakers
• Caching and bulkheads (separate resource pools)

Logging and Repudiation

Threats:

• Missing audit trail for sensitive actions
• Log tampering

Mitigations:

• Append-only audit logs for authz and data access
• Centralized log storage with access controls
• Include request IDs and actor identity in audit events

STRIDE Workshop (Step-by-Step)

1) Define Scope and Assets

Inputs:

• What is in scope (feature/system boundary)?
• What data is handled (PII, credentials, payments, proprietary)?
• What is the availability requirement (SLO/SLA)?

Outputs:

• Asset list (data + capabilities)
• Success criteria (what must be protected)

2) Draw Data Flows + Trust Boundaries

Keep the diagram simple:

• Actors (users, admins, services)
• Entry points (APIs, UIs, webhooks, background jobs)
• Data stores (DB, cache, object store)
• External dependencies (IdP, payment, email)

Mark trust boundaries:

• Public internet → edge
• Edge → internal network
• Internal service → database
• Service → third-party

3) STRIDE Per Element

STRIDE categories:

• Spoofing identity
• Tampering with data
• Repudiation
• Information disclosure
• Denial of service
• Elevation of privilege

Use a table to force completeness:

4) Score and Prioritize

Simple scoring:

• Likelihood: Low/Med/High
• Impact: Low/Med/High

Prioritize:

• High impact + Med/High likelihood
• High likelihood availability issues (DoS) for critical paths

5) Turn Mitigations Into Work

Convert mitigations into:

• Engineering tasks (RBAC, rate limiting, encryption)
• Verification tasks (tests, alerting, logging)
• Operational controls (incident runbooks, access reviews)

6) Validate and Iterate

Trigger updates:

• New data store or trust boundary
• Auth flow changes
• New third-party integrations
• Major scaling changes

Threat Modeling Templates

Threat Model Doc (Markdown)

# Threat Model: <System/Feature>

Date: YYYY-MM-DD
Owner: <name/team>
Scope: <what is in scope / out of scope>

## Assets
- <asset 1>
- <asset 2>

## Data Flows and Trust Boundaries
<diagram link or table>

## Assumptions
- <assumption 1>

## Threat Register
| Element | STRIDE | Threat | Impact | Likelihood | Mitigation | Owner | Status |
| --- | --- | --- | --- | --- | --- | --- | --- |

## Security Requirements
- <requirement 1>
- <requirement 2>

## Verification
- <test/alert/logging checks>

Threat Register (CSV-Friendly)

element,stride,threat,impact,likelihood,mitigation,owner,status

PR Checklist Additions

• Threat model updated for new trust boundaries and data stores
• Authn/authz checks added for new endpoints and resources
• Abuse cases and negative tests added for critical flows
• Audit logging added for privileged actions