dstreefkerk Threat Modelling
Source: Shostack, Threat Modeling: Designing for Security (Wiley, 2014). All citations point back to chapters and sections in that book.
This skill is a comprehensive reference for design-time threat modelling. It is organised as a router — this SKILL.md tells you what reference files to read for any threat-modelling task. The references contain the detail.
The Four Questions
Every threat-modelling activity reduces to four questions. Always anchor your work here:
- What are we working on? Model the system. Almost always: a Data Flow Diagram (DFD) with trust boundaries. See DFDs and trust boundaries below.
- What can go wrong? Find threats. Several techniques — STRIDE, attack trees, attack libraries, LINDDUN. See
references/stride.md,references/attack-trees.md,references/attack-libraries.md,references/privacy-techniques.md. - What are we going to do about it? Mitigate. Per-letter mitigations plus risk strategies. See
references/mitigations.md,references/risk-and-tradeoffs.md. - Did we do a good job? Validate. Test the mitigations; QA the threat model itself. See
references/processing-and-validation.md.
Use these as the structure of any threat-modelling output. A complete deliverable answers all four — anything less is incomplete.
DFDs and trust boundaries — universally applicable
Threat modelling almost always starts with drawing a system. The standard notation is a Data Flow Diagram (DFD) with five element types and one critical addition:
- External entities (rectangle) — users, other systems outside your control.
- Processes (circle) — your code running.
- Data stores (parallel lines) — files, databases, logs.
- Data flows (arrow) — data moving between elements.
- Trust boundaries (dotted line) — where principals interact and threats cluster.
Trust boundaries are the most important element. Threats cluster where they cross. If you draw nothing else, draw trust boundaries.
Two universal heuristics:
- Every data flow crossing a trust boundary deserves attention.
- A process on one side of a trust boundary should not implicitly trust data from the other side.
For full DFD treatment including notation, element semantics, and per-element STRIDE applicability, see references/stride.md §3.
Choosing a technique — decision tree
| Situation | Start here |
|---|---|
| New to threat modelling; getting a team started | references/eop-card-deck.md (Elevation of Privilege card game) + references/stride.md |
| Standard system threat-modelling workflow | references/stride.md (STRIDE) + references/processing-and-validation.md |
| Comparing methodologies / asked "should we use PASTA / hTMM / Trike / VAST / quantitative instead of STRIDE?" | references/methodology-comparison.md (PASTA 7 stages, hTMM, Trike methodology, VAST honest assessment, QTMM, FAIR-CAM, decision matrix) |
| Regulated AU financial-services engagement; risk-centric methodology required; threat model must feed business-impact analysis | references/methodology-comparison.md §1 (PASTA) + references/financial-services-regulatory-frame.md |
| Specific high-value flow needs deep analysis | references/attack-trees.md |
| Web app, API, framework-heavy system | references/attack-libraries.md (CAPEC 3.9, OWASP Top Ten 2025, ASVS 5.0.0, MASVS 2.1.0 / MASTG 2.0.0 / MASWE 1.0.0, WSTG, Proactive Controls v4) |
| Privacy is central (PII, surveillance concerns, GDPR/APP) | references/privacy-techniques.md (Solove, LINDDUN GO 2020/2024, LINDDUN PRO, Contextual Integrity) |
| Privacy is central AND need NIST alignment (CSF 2.0 already in use) | references/requirements-cookbook.md §6.5 (NIST Privacy Framework v1.1 IPD, five Core functions verbatim, CSF 2.0 mapping) |
| Operational SOC / blue-team modelling | references/experimental-approaches.md (Kill Chains, Threat Genomics, Broad Street) |
| Designing requirements before code exists | references/requirements-cookbook.md |
| NIST CSF 2.0 (six functions including Govern), NIST SP 800-53 Rev. 5 / Release 5.2.0, CSA CCM v4.1, PCI-DSS v4.0.1, NIST Privacy Framework v1.1 (IPD; five Core functions with -P suffix) | references/requirements-cookbook.md §6 |
| Choosing risk-handling strategy for a found threat | references/risk-and-tradeoffs.md |
| Need an attacker list / persona | references/attackers-and-assets.md |
| Modern adversary catalogues — MITRE ATT&CK Groups, Mandiant UNC, CrowdStrike (Bear/Panda/Spider), Microsoft Storm-/Sea- naming | references/attackers-and-assets.md §10.5 |
| Web, cloud, or mobile system | references/domain-web-cloud.md |
| Login, account, identity, or recovery flow | references/domain-accounts-identity.md |
| Passkeys, WebAuthn, FIDO2 (consumer phishing-resistant auth) | references/domain-accounts-identity.md §2.6 |
| Anything human-in-the-loop (warnings, scams, ceremonies) | references/domain-human-factors.md |
| Dark patterns, consent fatigue, deceptive design | references/domain-human-factors.md §8.3 |
| Cryptosystem design or review | references/domain-cryptosystems.md |
| Post-quantum cryptography / PQC migration (FIPS 203 ML-KEM, FIPS 204 ML-DSA, FIPS 205 SLH-DSA) | references/domain-cryptosystems.md §7 |
| Selling threat modelling to your organisation | references/organisational-adoption.md |
| Threat-modelling session is producing nothing / dragging | references/architecting-for-success.md |
| Validating an existing threat model | references/processing-and-validation.md |
| Looking up a term | references/glossary.md |
| Want a worked example | references/case-studies.md |
| AI/ML — first time threat-modelling an AI system | references/ai-ml-overview.md (start here, then route into the others) |
| AI/ML — adversarial-ML attacks (evasion, poisoning, extraction, inversion, membership inference) | references/adversarial-ml-attacks.md |
| AI/ML — LLM-integrated app, RAG, chatbot, copilot | references/llm-and-generative-ai-threats.md (OWASP LLM Top 10 2026) |
| AI/ML — AI agent that calls tools, browses, sends email, files tickets | references/agentic-ai-threats.md (OWASP ASI Top 10 2026) |
| AI/ML — ATT&CK-style adversary catalogue for AI | references/mitre-atlas.md |
| AI/ML — STRIDE across the data/training/deployment pipeline | references/ai-pipeline-threats.md |
| AI/ML — choosing defences for an identified AI threat | references/ai-mitigations.md |
| AI/ML — privacy (differential privacy, federated learning, training-data extraction defences, PLOT4AI) | references/ai-privacy-techniques.md |
| AI/ML — governance, regulatory, NIST AI RMF, EU AI Act (Digital Omnibus dates), Australian Voluntary AI Safety Standard / Guidance for AI Adoption, ISO 42001 | references/ai-governance-and-requirements.md |
| AI/ML — worked example | references/ai-case-studies.md |
| Cloud-native — first time threat-modelling a Kubernetes / serverless / multi-cloud system | references/cloud-native-overview.md (start here, then route into the others) |
| Cloud-native — adversary lens (MITRE ATT&CK for Cloud and Containers) | references/mitre-attack-cloud-and-containers.md |
| Cloud-native — Kubernetes-specific (RBAC, etcd, kubelet, admission, pod security) | references/kubernetes-threats.md |
| Cloud-native — container/image supply chain, SLSA, Sigstore, SBOM | references/container-supply-chain.md |
| Cloud-native — Lambda / Cloud Functions / Azure Functions / event-driven; WebAssembly at the edge (Cloudflare Workers, Fastly Compute, Fermyon Spin, WasmEdge, Wasmtime); capability sandbox vs container | references/serverless-and-event-driven.md (Wasm in §11) |
| CI/CD — first time threat-modelling a pipeline as production infrastructure | references/cicd-overview.md (start here, then route into the others) |
| CI/CD — source-control / Git platform threats (branch protection, PR abuse, signed commits, Dependabot/Renovate, fork-PR token leaks) | references/source-control-threats.md |
| CI/CD — build environment threats (runners, OIDC trust policies, secrets in env/logs, cache poisoning, third-party Actions) | references/build-environment-threats.md |
| CI/CD — dependency confusion, typosquatting, lockfile manipulation, ecosystem-specific patterns | references/dependency-and-registry-threats.md |
| CI/CD — IaC misconfiguration, state files, policy-as-code bypass (Terraform / CFN / Pulumi / Bicep / Crossplane) | references/iac-threats.md |
| CI/CD — GitOps (ArgoCD, Flux, sealed-secrets, SOPS, app-of-apps, manifest source-repo compromise) | references/gitops-threats.md |
| CI/CD — frameworks reference (SLSA, in-toto, Sigstore, SBOM, NIST SSDF, OpenSSF Scorecard, OWASP CI/CD Top 10 verbatim) | references/supply-chain-frameworks.md |
| CI/CD — worked incident analysis (SolarWinds, CodeCov, Heroku/Travis, Ledger Connect Kit, XZ Utils, tj-actions/changed-files, typosquatting campaigns, Cyberhaven 2024) | references/cicd-case-studies.md |
| Browser extension threat modelling; Manifest V3 architecture; extension store as trust boundary; enterprise allow-listing; Cyberhaven 2024 worked example | references/dependency-and-registry-threats.md §11 + references/cicd-case-studies.md §8 |
| CI/CD — defence-in-depth controls (branch protection, OIDC, ephemeral runners, signing, attestation, egress allow-listing, drift detection) | references/cicd-mitigations.md |
| Cloud-native — cloud IAM, workload identity, IMDS, federated identity, token theft | references/cloud-iam-and-identity.md |
| Cloud-native — storage, KMS, VPC, service mesh, API gateway, WAF, DNS | references/cloud-data-network-mesh.md |
| Cloud-native — choosing defences (Zero Trust, OPA, Kyverno, Falco, Tetragon, signing, secrets) | references/cloud-native-mitigations.md |
| Cloud-native — real incidents to learn from (Capital One, SolarWinds, CodeCov, Log4Shell, Storm-0558, XZ Utils, Snowflake, Medibank) | references/cloud-incident-case-studies.md |
| API security — first time threat-modelling a REST / GraphQL API, OAuth flow, or webhook | references/api-security-overview.md (start here, then route into the others) |
| API security — OWASP API Security Top 10 2023 verbatim and STRIDE/AINCAA mappings | references/owasp-api-top10.md |
| API security — OAuth 2.0 / OIDC flow review; JWT, PKCE, DPoP, mTLS-bound tokens, refresh-token rotation (RFC 6819 / 9700 / 8725 / 10017) | references/oauth2-and-oidc-threats.md |
| API security — GraphQL endpoint (depth, complexity, alias, batch, introspection, field-level authz, persisted queries, Apollo/Hasura federation) | references/graphql-threats.md |
| API security — REST endpoint design (BOLA, BFLA, mass assignment, SSRF, parameter pollution, content-type confusion, request smuggling) | references/rest-api-design-threats.md |
| API security — webhooks inbound (signature verification, replay, idempotency, Standard Webhooks) and outbound (SSRF, allow-listing, retries) | references/webhook-security.md |
| API security — multi-tenant SaaS, B2B partner API ecosystem, per-partner credential design, partner-compromise blast radius, tenant isolation | references/multi-tenant-and-partner-api-threats.md |
| API security — consolidated mitigations (auth strategy, authz patterns, schema validation, rate limiting, gateway, runtime API protection, contract testing) | references/api-mitigations.md |
| API security — worked breach incidents (T-Mobile, Twitter, Optus, Latitude, Coinbase, USPS, Peloton, Facebook View As) | references/api-case-studies.md |
| Sprint-pace TM — fast-moving project with a deadline; need a minimum-viable threat model; 60-minute / 4-hour / 1-day patterns | references/time-pressured-threat-modelling.md |
| Sprint-pace TM — multi-squad coordination; seam reviews; system-level threat-model-of-threat-models; shared trust boundaries | references/multi-squad-coordination.md |
| Sprint-pace TM — project kickoff toolkit; first-cut DFD; pre-mortem; engagement model; first-week checklist | references/kickoff-and-first-week-deliverables.md |
| Sprint-pace TM — continuous TM in delivery; CTM cadence; ADRs; TM-as-code (pytm, Threagile, IriusRisk); security-champion model | references/continuous-threat-modelling.md |
| Sprint-pace TM — negotiating with PMs and squad leads; non-negotiables; risk-acceptance forms; escalation; disagree-and-commit | references/security-risk-negotiation.md |
| Sprint-pace TM — Threat Modeling Manifesto verbatim; OWASP SAMM v2 levels; BSIMM16 AM activities (Black Duck, Feb 2026); Microsoft SDL; planning the maturity arc | references/threat-modelling-manifesto-and-maturity.md |
| AU regulatory — Privacy Act 1988; 13 APPs verbatim; NDB scheme; 2024 amendments (tiered penalties, statutory tort, ADM transparency); CDR; IVS Act 2023 | references/australian-privacy-landscape.md |
| AU regulatory — financial-services frame; APRA CPS 234 (in force), CPS 230 (in force from 1 July 2025), CPS 231 (superseded by CPS 230); NCCP / RG 209 responsible lending; AUSTRAC AML/CTF; ASIC ePayments Code | references/financial-services-regulatory-frame.md |
| AU regulatory — identity-document handling; DVS, FVS, Digital ID, IVS Act 2023; verify-and-discard; per-state DL format; post-Optus / Latitude data toxicity | references/identity-document-handling.md |
| AU regulatory — consequential AI; 8 AI Ethics Principles verbatim; Voluntary AI Safety Standard 10 guardrails verbatim; Guidance for AI Adoption six practices (mandatory guardrails not proceeding); ADM transparency; EU AI Act overlay; APRA model risk | references/regulated-ai-decisioning.md |
| AU regulatory — vendor and third-party data sharing; APP 8 cross-border; CPS 230 material service provider; processing agreements; Modern Slavery; SOCI Act; Cyber Security Act 2024; sovereign cloud / data residency | references/vendor-data-sharing-threats.md (Cyber Security Act in §10.3; sovereign cloud in §13) |
| AU regulatory — OAIC Privacy Impact Assessment process; 10 steps verbatim; PIA vs privacy threat model; PIA outputs as design-time inputs | references/oaic-pia-process.md |
| AU regulatory — worked incidents (Optus 2022, Medibank 2022, Latitude 2023, HWL Ebsworth 2023, MediSecure 2024, Service NSW 2020) | references/au-regulated-industry-case-studies.md |
| OT / ICS / IoT — first time threat-modelling a plant, refinery, water utility, substation, building automation, IoT fleet | references/ot-ics-iot-threats.md (Purdue, IEC 62443 zones/conduits, ATT&CK for ICS 12 tactics, NIST 800-82r3, safety-override property, IoT-at-scale, AU SOCI/CIRMP) |
| OT — IEC 62443 zones and conduits; four Security Levels (SL 1–4); SL-T mismatch analysis | references/ot-ics-iot-threats.md §3 |
| OT — Purdue Reference Model; Level 3.5 industrial DMZ; IT/OT boundary | references/ot-ics-iot-threats.md §2 |
| OT — MITRE ATT&CK for ICS 12 tactics verbatim (incl. Inhibit Response Function TA0107, Impair Process Control TA0106) | references/ot-ics-iot-threats.md §4 |
| OT — NIST SP 800-82 Rev. 3 (Sept 2023); OT overlay for SP 800-53 Rev. 5 | references/ot-ics-iot-threats.md §5 |
| OT — safety-instrumented systems (SIS); IEC 61511 / ANSI ISA-84; safety-override property | references/ot-ics-iot-threats.md §6 |
| IoT — consumer / prosumer IoT at scale; OTA update channel; default credentials; ETSI EN 303 645; OWASP IoT Top 10 | references/ot-ics-iot-threats.md §7 |
| AU SOCI Act / CIRMP / 11 critical-infrastructure sectors / AESCSF / energy-sector cyber framework | references/ot-ics-iot-threats.md §8 (with cross-references to vendor-data-sharing-threats.md) |
| OT worked incidents — Triton (2017), Industroyer / Industroyer2 (2016, 2022), Pipedream (2022), Colonial Pipeline (2021), Oldsmar water (2021), FrostyGoop (2024) | references/ot-ics-iot-threats.md §9 |
| Confidential computing / TEE / Trusted Execution Environment / cloud-provider in the threat model; data clean rooms (AWS, Snowflake, Decentriq, Ads Data Hub) | references/confidential-computing-and-tees.md (trust-boundary shift, Intel TDX / AMD SEV-SNP / Arm CCA / NVIDIA GPU TEE, RFC 9334 RATS, Apple PCC five properties verbatim, confidential AI, TEE.fail and side-channel limitations, data clean rooms in §10) |
| Apple Private Cloud Compute / PCC / non-targetability / verifiable transparency | references/confidential-computing-and-tees.md §5 |
| Remote attestation / RATS / RFC 9334 / Attester / Verifier / Relying Party / Passport vs Background-Check | references/confidential-computing-and-tees.md §4 |
| AWS Nitro Enclaves / KMS attestation condition keys / Azure Confidential VMs / GCP Confidential VMs | references/confidential-computing-and-tees.md §3 |
| Confidential AI / inference inside TEE / H100 + TDX composite attestation / private prompt | references/confidential-computing-and-tees.md §6 (with cross-refs to ai-mitigations.md and ai-privacy-techniques.md) |
| TEE.fail / SGXPectre / Foreshadow / Downfall / ÆPIC Leak / TEE side-channel limitations | references/confidential-computing-and-tees.md §7 — read before recommending |
| Designing hardware / firmware / embedded product; manufacturer scoping EU CRA, UK PSTI, CISA Secure by Design compliance | references/hardware-firmware-embedded.md (TPM 2.0, Secure Enclave, TrustZone, Pluton; UEFI Secure Boot, verified boot, measured boot; side-channels; JTAG / glitching / chip-off; firmware supply chain incl. TUF / Uptane / SUIT / HBOM; MITRE EMB3D v2.0; EU CRA Annex I; UK PSTI three requirements; CISA Secure by Design three principles) |
| EU Cyber Resilience Act (Reg (EU) 2024/2847) / Annex I / 24h vulnerability notification / Class II products | references/hardware-firmware-embedded.md §8.1 |
| UK PSTI Act 2022 / three security requirements / Statement of Compliance | references/hardware-firmware-embedded.md §8.2 |
| MITRE EMB3D v2.0 / hardware-firmware-applications-networking threat categories / Foundational-Intermediate-Leading mitigation tiers | references/hardware-firmware-embedded.md §7 |
| TPM 2.0 / Secure Enclave / TrustZone / Microsoft Pluton / HSM design choice | references/hardware-firmware-embedded.md §2 |
| Secure boot / verified boot / measured boot / chain of trust as DFD pattern | references/hardware-firmware-embedded.md §3 |
| Firmware update — TUF, Uptane, SUIT (RFC 9019), HBOM, NIST SP 800-147 / 800-193 | references/hardware-firmware-embedded.md §6 |
| Medical device cybersecurity / SaMD / FDA premarket cybersecurity guidance (Feb 2026) / IEC 62304 / IEC 81001-5-1 / IMDRF / TGA AU SaMD guidance | references/medical-device-cybersecurity.md |
| Automotive cybersecurity / ISO/SAE 21434 / UN R155 CSMS / UN R156 SUMS / TARA / in-vehicle ECU / CAN / V2X / ADAS | references/automotive-cybersecurity.md |
| Using an LLM / AI assistant to do threat modelling; StrideGPT, AWS Threat Composer, Microsoft Security Copilot, IriusRisk AI features; how to use these well without inheriting their failure modes | references/ai-assisted-threat-modelling.md |
| Modern AI red-teaming tooling — PyRIT (Microsoft), Garak (NVIDIA), Promptfoo, NeMo Guardrails, OpenAI Evals | references/ai-mitigations.md §10 (refreshed) + references/ai-assisted-threat-modelling.md §8 |
| MITRE D3FEND defensive-technique mapping; ATT&CK-to-D3FEND mapping; STRIDE-to-D3FEND crosswalk; D3FEND OT extension | references/d3fend-mitigation-mapping.md |
| VEX / Vulnerability Exploitability eXchange / four status values / CSAF v2.0 / OASIS Standard / SBOM + VEX + CSAF triad | references/supply-chain-frameworks.md §§4a-4b |
| Bridging TM output to detection engineering / Sigma rules / Detection-as-Code (Panther, Sentinel Repositories, Splunk, Chronicle) / Atomic Red Team validation | references/processing-and-validation.md §13 |
For most workflows, read at least stride.md and processing-and-validation.md. The other references load as needed.
Reference index
All files are in references/ relative to this SKILL.md.
| # | File | Source chapter | What's in it |
|---|---|---|---|
| 1 | stride.md |
Ch. 3, 8 | STRIDE letters, AINCAA, DFD applicability, STRIDE-per-Element / per-Interaction / DESIST, mitigation summary |
| 2 | attack-trees.md |
Ch. 4, App B | Tree methodology + all 18 catalogued trees (B-1 to B-15 STRIDE trees plus the four extras) |
| 3 | attack-libraries.md |
Ch. 5 | CAPEC 3.9 categories, OWASP Top Ten 2025 verbatim, OWASP ASVS 5.0.0, MASVS 2.1.0 / MASTG 2.0.0 / MASWE 1.0.0, WSTG 4.2, Proactive Controls v4 — libraries vs checklists vs literature reviews |
| 4 | privacy-techniques.md |
Ch. 6, 8 | Solove taxonomy, IETF RFC 6973, PIAs, Nymity Slider, Contextual Integrity, LINDDUN family (2010 original; GO 2020 / card deck redesigned 2024; PRO process pattern; MAESTRO 2025) with current canonical seven-category list verbatim, privacy mitigations |
| 5 | mitigations.md |
Ch. 8 | Full per-STRIDE-letter mitigations, Holly Towle's 10 PII principles, Standard Deployments, traps |
| 6 | risk-and-tradeoffs.md |
Ch. 9 | Five risk strategies (avoid/address/accept/transfer/ignore), Bug Bar, FAIR, "Fuzzing is not a mitigation", arms races |
| 7 | processing-and-validation.md |
Ch. 7, 10 | When/where to start, top-down vs bottom-up, three lists to iterate across, mitigation order, Playing Chess, Running from the Bear, threats tables, assumption tracking, External Security Notes, customer-vendor boundary, new tech, 7-step API checklist, validation, model/reality conformance |
| 8 | requirements-cookbook.md |
Ch. 12 | Business, prevent/detect/respond, people/process/technology, dev vs acquisition, compliance (CSA CCM v4.1; NIST CSF 2.0 with six functions verbatim incl. Govern; NIST SP 800-53 Rev. 5 / Release 5.2.0; PCI-DSS v4.0.1; NIST Privacy Framework v1.1 IPD (14 April 2025) — five Core functions verbatim with -P suffix and CSF 2.0 mapping), privacy (FIPs, Privacy by Design, Seven Laws of Identity, MPSD), STRIDE requirements by AINCAA, non-requirements with Microsoft's 10 Immutable Laws |
| 9 | domain-web-cloud.md |
Ch. 13 | Web, browser+plugin, cloud tenant, cloud provider, mobile |
| 10 | domain-accounts-identity.md |
Ch. 14 | Account life cycle, authentication, account recovery, names/IDs/SSNs — all four read-aloud checklists; §2.6 Passkeys, WebAuthn, FIDO2 (W3C WebAuthn Level 3 Recommendation, 25 Aug 2026) |
| 11 | domain-human-factors.md |
Ch. 15 | Three models of people, ceremonies, Ceremony Analysis Heuristics, Stajano-Wilson scam principles, NEAT, SPRUCE, Gold Bar, kind learning environments, scamicry; §8.3 Dark patterns / consent fatigue (EU DSA, GDPR Art 7, EDPB Guidelines 03/2022, ACCC, FTC) |
| 12 | domain-cryptosystems.md |
Ch. 16 | Primitives (basic, privacy, modern), classic actors, attacks, six things to remember, Kerckhoffs; §7 Post-quantum cryptography and crypto-agility (FIPS 203 ML-KEM, FIPS 204 ML-DSA, FIPS 205 SLH-DSA — finalised 13 August 2024; NIST IR 8547; CISA PQC; CNSA 2.0) |
| 13 | organisational-adoption.md |
Ch. 17 | Selling to ICs vs management, who does what, dev lifecycle integration, the three objection families with counters |
| 14 | experimental-approaches.md |
Ch. 18 | Seams, FlipIT, Kill Chains (LM + Threat Genomics), Broad Street, adversarial ML, business TM, dangerous deliverables and approaches, how to experiment |
| 15 | architecting-for-success.md |
Ch. 19 | Flow, cognitive load, creator blindness, boundary objects, best vs good, "the threat model has changed", artistry |
| 16 | attackers-and-assets.md |
App A, C | Network/physical/people/supply-chain/privacy/non-sentient attackers, Internet Threat Model (RFC 3552), asset catalogues, Barnard, Verizon DBIR 2026, OWASP, Intel TARA, Aucsmith's 8 personas, §10.5 Modern adversary catalogues (MITRE ATT&CK Groups, Mandiant UNC, CrowdStrike adversary naming, Microsoft Storm-/Sea- naming) |
| 17 | eop-card-deck.md |
App D | Every card in every suit with discussion |
| 18 | case-studies.md |
App E | Acme Database (by element), Acme Operational Network (by threat), Phones+OTT (by requirement), iNTegrity classroom exercise |
| 19 | tools-catalogue.md |
Ch. 11 | Whiteboards, office, bug trackers, TRIKE, EoP, ThreatModeler, Corporate Threat Modeller, SecurITree, Little-JIL, MS SDL TM Tool 2016 (long-term maintenance); modern open-source: OWASP Threat Dragon, pytm, Threagile; current commercial: IriusRisk; SeaMonster (abandoned); §5 AI-assisted tools (routes to #74) |
| 20 | glossary.md |
Glossary | Every term defined in the book |
| 20b | methodology-comparison.md |
UcedaVelez & Morana 2015; CMU/SEI-2018-TN-002 (Mead et al. 2018); octotrike.org; ThreatModeler VAST; FAIR Institute on FAIR-CAM (2021) | PASTA seven stages verbatim with choose / do-not-choose criteria; hTMM five steps verbatim (Security Cards + STRIDE + PnG synthesis); Trike actor-asset-action methodology (methodology vs unmaintained tool); VAST honest assessment as a vendor label; QTMM (STRIDE + attack trees + CVSS); FAIR-CAM three control categories; decision matrix mapping engagement characteristics to recommended methodology. Hard rule preserved — STRIDE remains the default for new teams. |
| 71 | ot-ics-iot-threats.md |
IEC 62443 series (ISA / IEC; 62443-4-2:2026); NIST SP 800-82 Rev. 3 (Sept 2023; Rev. 4 IPD 2026); MITRE ATT&CK for ICS v19.2; ANSI/ISA-95 Purdue model; AU SOCI Act 2018 + CIRMP Rules; AESCSF v2; ETSI EN 303 645; OWASP IoT Top 10; Dragos public reporting | OT/ICS/IoT extension. Why OT needs its own lens (safety override; deterministic real-time; air-gap-as-myth); Purdue levels 0–4 + 3.5 DMZ; IEC 62443 zones, conduits and four Security Levels paraphrased; MITRE ATT&CK for ICS 12 tactics verbatim with TA IDs (incl. Inhibit Response Function TA0107 and Impair Process Control TA0106); NIST SP 800-82 Rev. 3 OT overlay; STRIDE adaptation with Safety as sixth property; IoT-at-scale (OTA update, default creds, decommissioning); AU SOCI Act 2018 with 11 designated sectors + CIRMP all-hazards framework + AESCSF; worked incidents (Triton, Industroyer / Industroyer2, Pipedream, Colonial Pipeline, Oldsmar, FrostyGoop); four additional OT/IoT universal heuristics. |
| 72 | confidential-computing-and-tees.md |
Apple PCC (June 2024); IETF RFC 9334 RATS (Jan 2023); Intel TDX overview; AMD SEV-SNP developer pages; Arm CCA; AWS Nitro Enclaves docs and KMS condition keys; Azure Confidential Computing; Google Confidential Computing; NVIDIA H100 / H200 / B200 confidential compute; Confidential Computing Consortium; TEE.fail paper (2025) | Confidential computing / TEE extension. Trust-boundary shift (cloud provider outside trust boundary); Intel TDX / AMD SEV-SNP / Arm CCA / NVIDIA GPU TEE comparison matrix; AWS / Azure / GCP confidential offerings including AWS KMS attestation condition keys verbatim; IETF RATS three principal roles (Attester, Verifier, Relying Party) and two topological patterns (Passport, Background-Check); Apple PCC five properties verbatim; confidential AI (H100/B200 + TDX/SEV-SNP composite attestation); honest TEE limitations including TEE.fail 2025 attack, SGX/TDX/SEV-SNP side-channel history, attestation-infrastructure risk, trust-the-vendor problem; when to use and when not. |
| 73 | hardware-firmware-embedded.md |
EU Regulation 2024/2847 (CRA; reporting obligations in force 11 Sept 2026); UK PSTI Act 2022 + Regs 2023; CISA Secure by Design joint guidance; MITRE EMB3D v2.0.2 (June 2026); TCG TPM 2.0 Library; NIST SP 800-147 (April 2011); NIST SP 800-193 (May 2018); IETF RFC 9019 SUIT; TUF / Uptane; AU Voluntary Code of Practice for Consumer IoT (2020) | Device-level hardware / firmware / embedded extension distinct from #71's system level. Hardware roots of trust (TPM 2.0; Apple Secure Enclave; Arm TrustZone A and M; Microsoft Pluton; HSMs); UEFI Secure Boot + verified boot + measured boot chain-of-trust as DFD pattern; side-channel attacks design-time relevance; physical attacks (JTAG, glitching, chip-off, bus interposition); firmware supply chain (NIST 800-147 / 800-193; TUF / Uptane / SUIT; HBOM); MITRE EMB3D v2.0 with four threat categories and three mitigation tiers; EU CRA Annex I and 24h vulnerability reporting; UK PSTI three requirements verbatim; CISA Secure by Design three principles verbatim; AU Voluntary Code; worked smart-camera example. |
| 76 | medical-device-cybersecurity.md |
FDA Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions (Feb 2026; supersedes June 2025 and Sept 2023 editions); IEC 62304 + Edition 2 in development; IEC 81001-5-1:2021; IMDRF SaMD framework + N81 (Jan 2025); TGA SaMD guidance (Aug 2025); MDIC playbooks; MITRE Medical Device Cybersecurity Regional Incident Preparedness and Response Playbook | Medical device cybersecurity extension. Scope (Class II/III; SaMD; IEC 81001-5-1 health software). FDA premarket cybersecurity guidance required submission components (SBOM; risk management; KEV-catalogue vulnerabilities; security architecture views). IEC 62304 software safety classes A/B/C and Edition 2 two-level transition. IEC 81001-5-1 two security levels and lifecycle activities (incl. mandatory threat modelling at Security Level II). IMDRF SaMD characterisation framework and Jan 2025 N81. TGA SaMD guidance (Aug 2025) with AI/adaptive-algorithm focus and AU privacy overlay. Six medical-device-specific threat classes (workflow disruption; infusion-pump tampering; imaging modality compromise; HL7/FHIR integration; connected-implant remote-access; cybersecurity-driven end-of-support). Worked infusion-pump-fleet TM. Two universal heuristics: patient safety overrides cybersecurity; maintain support for full clinical lifetime. |
| 77 | automotive-cybersecurity.md |
ISO/SAE 21434:2021; UN Regulation No. 155 (in force July 2022 for new types, all new vehicles from July 2024); UN Regulation No. 156 (SUMS); SAE J3061 (historical); ENISA Good practices for the security of smart cars; Uptane | Automotive cybersecurity extension. ISO/SAE 21434 lifecycle (concept / product development / cybersecurity validation / operations / decommissioning) with TARA seven-step process (asset / threat scenario / impact (SFOP) / attack path / feasibility / risk / treatment). UN R155 two-tier compliance (organisational CSMS Certificate of Compliance + per-vehicle-type cybersecurity type approval). UN R156 SUMS with Uptane-compatible OTA properties. In-vehicle threat model — ECUs and gateway; CAN/CAN-FD/LIN/FlexRay/Automotive Ethernet (unauthenticated by default); IVI; TCU (highest-value remote target); V2X / C-V2X / DSRC; ADAS sensors. Aftermarket and CSA-supplier supply chain. Worked connected-ECU-with-OTA TM. Two universal heuristics: functional safety (ISO 26262) and cybersecurity are parallel regimes; CSMS is organisational, type approval is per-vehicle. |
| 74 | ai-assisted-threat-modelling.md |
StrideGPT (Matt Adams 2023+); AWS Threat Composer (AWS Labs); Microsoft Security Copilot; IriusRisk AI features; Microsoft PyRIT (microsoft/PyRIT, v1.1.0 Sept 2026); NVIDIA Garak; Promptfoo (OpenAI-owned since Mar 2026); NVIDIA NeMo Guardrails; OpenAI Evals (hosted platform closing 30 Nov 2026) |
The meta-extension: practitioner-side use of AI in TM workflow. What changed and what stayed the same (the four questions); the AI-assisted TM tools (StrideGPT, AWS Threat Composer, Microsoft Security Copilot, IriusRisk AI, custom workflows); when AI-assisted TM helps and when not; the meta-risk of using LLMs to threat-model LLM-integrated systems (the agentic-AI authority pyramid applies to the TM assistant itself); workflow patterns for kickoff / continuous TM / seam reviews; evaluating LLM output against processing-and-validation.md §11; modern AI red-teaming toolchain (PyRIT, Garak, Promptfoo, NeMo Guardrails, OpenAI Evals) replacing the Perez 2022 reference in ai-mitigations.md §10. Tool currency anchored to retrieval date 2026-09-16. |
| 75 | d3fend-mitigation-mapping.md |
MITRE D3FEND v1.6.0 (d3fend.mitre.org, 31 Aug 2026; OT extension Dec 2025); D3FEND-CKG; ATT&CK-D3FEND mapping |
Defensive counterpart to ATT&CK. Seven D3FEND tactics verbatim (Model, Harden, Detect, Isolate, Deceive, Evict, Restore); ATT&CK-to-D3FEND mapping workflow; STRIDE-to-D3FEND crosswalk; when to reach for D3FEND and when not. Closes the gap where SKILL.md listed D3FEND in framework state but no reference file used it. |
| 21 | ai-ml-overview.md |
AI/ML extension (2025-2026 synthesis) | Four questions applied to AI/ML; STRIDE-adapts-cleanly map; AI-specific elements that don't map; two AI universal heuristics; decision tree into the other AI files |
| 22 | adversarial-ml-attacks.md |
Biggio, Papernot, Madry, Goodfellow, Carlini, Athalye | Threat-model taxonomy (five dimensions); evasion (FGSM/PGD/C&W/transfer/physical); poisoning (targeted/untargeted/clean-label); backdoors; model extraction; model inversion; membership inference; transferability; obfuscated gradients |
| 23 | llm-and-generative-ai-threats.md |
OWASP LLM Top 10 2026 (3 Aug 2026); Greshake 2023; Wei 2023; Carlini 2021 | "Prompt is untrusted input"; direct vs indirect prompt injection; jailbreak failure modes (competing objectives, mismatched generalisation); OWASP LLM01–10:2026 verbatim (§§5–14 in 2026 order; 2025→2026 changes noted) with per-entry threats and mitigations; training-data extraction; RAG-specific threats |
| 24 | agentic-ai-threats.md |
OWASP ASI Top 10 2026; Microsoft Copilot Studio guidance; Anwar et al. 2024 | Authority pyramid (tools, identity, memory, autonomy); ASI01-10 verbatim with per-entry treatment; STRIDE in agentic systems; agent threat-modelling workflow |
| 25 | mitre-atlas.md |
atlas.mitre.org v2026.09 (15 Sept 2026; calendar versioning since v2026.05; monthly cadence) |
16 ATLAS tactics verbatim with non-sequential AML.TA IDs (AI Model Access AML.TA0000 and AI Attack Adaptation AML.TA0001 — renamed from AI Attack Staging in v2026.08 — are AI-specific; Lateral Movement AML.TA0015 added v5.1.0; Command and Control AML.TA0014 added v4.9.0); notable techniques table; three usage patterns; ATLAS vs OWASP vs NIST comparison |
| 26 | ai-pipeline-threats.md |
Microsoft AI/ML threat modelling (Marshall et al. 2019); ENISA AI threat landscape | STRIDE applied across 8 pipeline stages (collection, labelling, training, registry, deployment, serving, monitoring, feedback); cross-stage threats; Microsoft's three Key New Considerations |
| 27 | ai-mitigations.md |
Madry 2018; Abadi 2016; Mitchell 2019; Gebru 2018; Perez 2022; OWASP mitigation sections | Mitigations by attack category and by pipeline stage; adversarial training; tool sandboxing; poisoning defences; provenance artefacts (datasheets, model cards, AIBOM); watermarking; input/output filtering; system-prompt and structural separation; red-teaming; HITL; rate limiting; defences to be sceptical of |
| 28 | ai-privacy-techniques.md |
Dwork & Roth 2014; Abadi 2016; Kairouz 2021; Carlini 2021; PLOT4AI | Differential privacy fundamentals; data minimisation; defences against membership inference and extraction; federated learning and its privacy concerns; PLOT4AI (138 threats, 8 categories); mapping to Solove and LINDDUN |
| 29 | ai-governance-and-requirements.md |
NIST AI RMF 1.0; NIST AI 600-1 (Generative AI Profile, 26 July 2024); EU AI Act 2024/1689 as amended by the AI Digital Omnibus 2026/1744; ISO 42001/23894; Australia VAISS + Guidance for AI Adoption (Oct 2025); Australia AI Ethics Principles (canonical); OECD AI Principles | NIST 4 functions verbatim; EU AI Act 4 risk tiers verbatim plus phase-in (Annex III high-risk deferred to 2 Dec 2027, Annex I to 2 Aug 2028; Article 50 live since 2 Aug 2026); ISO outlines; Australia's 10 voluntary guardrails verbatim plus the six Guidance for AI Adoption essential practices verbatim (mandatory guardrails not proceeding); Australia's 8 AI Ethics Principles verbatim; OECD's 5 values-based principles verbatim; AI-system requirements pattern; AI non-requirements |
| 30 | ai-case-studies.md |
Public disclosures synthesised | Five worked examples: Tay (2016) feedback poisoning; Carlini 2021 training-data extraction; Bing Chat / Sydney indirect injection; Slack AI exfiltration; agentic Confluence-reading email-sending assistant |
| 31 | cloud-native-overview.md |
Cloud-native extension (2026 synthesis) | Control plane vs data plane; new cloud-native trust boundaries; STRIDE adaptations; shared-responsibility line; cloud-native universal heuristics; decision tree into the other cloud-native files |
| 32 | mitre-attack-cloud-and-containers.md |
attack.mitre.org v19.2 (agile release; v19 28 April 2026) Cloud + Containers matrices |
Full tactic lists verbatim — note Defense Evasion has been split into Stealth (TA0005) + Defense Impairment (TA0112) as of v19; major techniques per tactic with IDs; sub-matrices (IaaS, Identity Provider, SaaS, Office Suite); named adversary groups; usage as elicitation lens |
| 33 | kubernetes-threats.md |
Microsoft Threat Matrix for Kubernetes; OWASP K8s Top Ten 2025 (verbatim); CIS K8s Benchmark v2.0.1 control families; NIST SP 800-190 | Microsoft K8s threat matrix verbatim; OWASP K01-K10 verbatim; cluster components as DFD elements; RBAC misuse; pod-level threats; NetworkPolicy / admission control / Secrets; cluster-to-cloud lateral movement |
| 34 | container-supply-chain.md |
NIST SP 800-204D / 800-218 / 800-161; SLSA v1.2 (Nov 2025; Source Track now stabilised); Sigstore cosign v3.x / Rekor v2 (2025); in-toto v1.0 (CNCF graduated April 2025); CISA SCRM; XZ Utils 2024 analyses; CodeCov 2021 post-mortem (about.codecov.io/security-update/) |
Five elements of the container supply chain; build-time vs run-time; base-image and registry threats; dependency confusion; SLSA Build and Source levels verbatim; Sigstore (cosign, fulcio, rekor); SBOM and attestation; XZ Utils pattern; Dockerfile anti-patterns |
| 35 | serverless-and-event-driven.md |
AWS / Azure / GCP serverless docs; OWASP Serverless Top 10; NIST SP 800-204 / 800-204A | Event sources as the front door; execution role least privilege; function-event injection; cold-start abuse; layer/extension poisoning; Step Functions / Durable Functions; queue/topic misconfigurations; idempotency / Denial of Wallet |
| 36 | cicd-overview.md |
NIST SP 800-204D; CISA / NSA Defending CI/CD Environments (June 2023); OWASP CI/CD Top 10; SLSA v1.0 | CI/CD as production infrastructure; control plane vs data plane of the pipeline; new trust boundaries (developer→repo, repo→runner, runner→registry, registry→deploy); five high-impact public incidents as anchor; routing into the other CI/CD files; six CI/CD universal heuristics |
| 37 | source-control-threats.md |
GitHub / GitLab / Bitbucket / Azure DevOps docs; OWASP CICD-SEC-1, -2, -4, -5; Heroku / Travis OAuth 2022; tj-actions 2025 | Git-platform attacks; account and credential compromise; branch protection / ruleset bypass; PR abuse and pull_request_target footgun; signed commits / signed tags; force-push and tag mutability; secret scanning / push protection; Dependabot / Renovate as threat surface; fork-PR token leakage; webhook spoofing; repo transfer; SCM audit |
…(truncated)