Threat Modeling

Threat Modeling

What I Do

I provide guidance on systematically identifying, categorizing, and prioritizing security threats to applications and systems. This includes using frameworks like STRIDE and PASTA, creating data flow diagrams, analyzing attack surfaces, assessing risk, and recommending mitigations for identified threats.

When to Use Me

• Designing a new application or feature and need to identify security risks
• Performing a threat assessment of an existing system
• Creating data flow diagrams to identify trust boundaries
• Prioritizing security work based on risk
• Documenting threat models for compliance or review
• Evaluating the security impact of architectural changes

Core Concepts

1. STRIDE: Threat classification framework covering Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege.
2. Data Flow Diagrams: Visual representation of how data moves through a system, identifying processes, data stores, external entities, and trust boundaries.
3. Attack Surface Analysis: Enumeration of all entry points, interfaces, and data flows that an attacker could target.
4. Trust Boundaries: Lines in the architecture where the level of trust changes and where security controls must be enforced.
5. Risk Rating: Assessment of threat likelihood and impact (using DREAD, CVSS, or custom matrices) to prioritize mitigations.
6. PASTA: Process for Attack Simulation and Threat Analysis, a seven-stage risk-centric methodology.
7. Attack Trees: Hierarchical diagrams showing how an attacker could achieve a goal through different paths.

Code Examples

1. Threat Model Document Structure (Python Data Model)

from dataclasses import dataclass, field
from typing import List, Optional
from enum import Enum

class StrideCategory(Enum):
    SPOOFING = "Spoofing"
    TAMPERING = "Tampering"
    REPUDIATION = "Repudiation"
    INFO_DISCLOSURE = "Information Disclosure"
    DENIAL_OF_SERVICE = "Denial of Service"
    ELEVATION_OF_PRIVILEGE = "Elevation of Privilege"

class RiskLevel(Enum):
    CRITICAL = 4
    HIGH = 3
    MEDIUM = 2
    LOW = 1

@dataclass
class Threat:
    id: str
    title: str
    category: StrideCategory
    description: str
    affected_component: str
    risk: RiskLevel
    mitigations: List[str] = field(default_factory=list)
    status: str = "open"

@dataclass
class ThreatModel:
    name: str
    version: str
    components: List[str]
    trust_boundaries: List[str]
    threats: List[Threat] = field(default_factory=list)

    def threats_by_risk(self) -> List[Threat]:
        return sorted(self.threats, key=lambda t: t.risk.value, reverse=True)

    def open_threats(self) -> List[Threat]:
        return [t for t in self.threats if t.status == "open"]

2. Automated Attack Surface Enumeration (Python)

from typing import Dict, List, Set
import ast
import os

def find_api_endpoints(source_dir: str) -> List[Dict[str, str]]:
    endpoints: List[Dict[str, str]] = []
    for root, _, files in os.walk(source_dir):
        for fname in files:
            if not fname.endswith(".py"):
                continue
            filepath = os.path.join(root, fname)
            with open(filepath, "r") as f:
                try:
                    tree = ast.parse(f.read())
                except SyntaxError:
                    continue
            for node in ast.walk(tree):
                if isinstance(node, ast.Call):
                    func = node.func
                    if isinstance(func, ast.Attribute) and func.attr in (
                        "get", "post", "put", "delete", "patch", "route"
                    ):
                        for arg in node.args:
                            if isinstance(arg, ast.Constant) and isinstance(arg.value, str):
                                endpoints.append({
                                    "file": filepath,
                                    "method": func.attr.upper(),
                                    "path": arg.value,
                                    "line": node.lineno,
                                })
    return endpoints

3. STRIDE Analysis Helper (Python)

from typing import Dict, List

STRIDE_QUESTIONS: Dict[str, List[str]] = {
    "Spoofing": [
        "Can an attacker impersonate a legitimate user or service?",
        "Is authentication enforced on all entry points?",
        "Are credentials transmitted and stored securely?",
    ],
    "Tampering": [
        "Can data be modified in transit or at rest?",
        "Are integrity checks in place for critical data?",
        "Is input validated before processing?",
    ],
    "Repudiation": [
        "Can a user deny performing an action?",
        "Are audit logs tamper-proof and complete?",
        "Are critical operations logged with user identity?",
    ],
    "Information Disclosure": [
        "Can sensitive data be accessed by unauthorized users?",
        "Is data encrypted in transit and at rest?",
        "Do error messages reveal internal details?",
    ],
    "Denial of Service": [
        "Can the system be overwhelmed by excessive requests?",
        "Are rate limits and resource quotas in place?",
        "Are there single points of failure?",
    ],
    "Elevation of Privilege": [
        "Can a user gain privileges beyond their role?",
        "Is authorization checked on every operation?",
        "Are admin interfaces properly protected?",
    ],
}

def generate_stride_checklist(component: str) -> Dict[str, List[str]]:
    return {
        category: [f"[{component}] {q}" for q in questions]
        for category, questions in STRIDE_QUESTIONS.items()
    }

Best Practices

1. Threat model early in the design phase before code is written, and update when architecture changes.
2. Use data flow diagrams to visualize all components, data flows, and trust boundaries.
3. Apply STRIDE systematically to each component and data flow in the diagram.
4. Prioritize threats by risk using likelihood and impact rather than treating all threats equally.
5. Document mitigations for each threat with specific implementation details and ownership.
6. Review threat models with cross-functional teams including developers, architects, and security engineers.
7. Track threat model findings alongside other security work in the team's backlog.
8. Automate attack surface discovery to keep the inventory of entry points current.
9. Use abuse cases alongside use cases to ensure adversarial scenarios are considered.
10. Version threat models alongside the code they describe for traceability.