rysweet Threat Model Generator
Generate a threat model for the current investigation.
Process
- Review the attack surface:
skwaq surface - Review findings:
skwaq viz findings - Identify threat actors (who would attack this?)
- Map attack vectors (how could they attack?)
- Assess risks using STRIDE methodology:
- Spoofing - can identity be faked?
- Tampering - can data be modified?
- Repudiation - can actions be denied?
- Information Disclosure - can data leak?
- Denial of Service - can it be crashed?
- Elevation of Privilege - can access be escalated?
- Prioritize threats by likelihood and impact
- Suggest mitigations for top threats