Threat Modeling
This threat-models a system's components and data flows, not its code. Pick the one reference the task needs; don't load all four.
| Task |
File |
| Identify threats per component/interaction (STRIDE questionnaires, DFD trust-boundary analysis, threat-model doc template) |
references/stride.md |
| Map attack paths (OR/AND node model, path + coverage analysis, worked account-takeover example) |
references/attack-trees.md |
| Turn threats into requirements (STRIDE -> requirement patterns, compliance mapping with PCI-DSS/HIPAA/GDPR/OWASP-ASVS control IDs; SOC2/NIST CSF/ISO 27001 have no control-id table) |
references/requirements.md |
| Choose and prioritize controls (standard-controls library, defense-in-depth layering, coverage + gap analysis) |
references/mitigations.md |
Core Model
STRIDE categories and the property each violates:
| Threat |
Property violated |
| Spoofing |
Authentication |
| Tampering |
Integrity |
| Repudiation |
Non-repudiation |
| Information disclosure |
Confidentiality |
| Denial of service |
Availability |
| Elevation of privilege |
Authorization |
Attack trees: root = attacker goal; OR nodes (any child suffices), AND nodes (all children required), leaves = concrete attack steps scored by difficulty, cost, and detection risk. Cheapest complete path = priority defense target.
Control categories, in layering order: preventive (stop), detective (notice), corrective (recover). Deterrent and compensating controls sit outside that order. A threat counts as covered only when both a preventive control and a detective control apply.
Workflow
- Define scope and trust boundaries.
- Draw the data flow diagram (flows and boundaries, not just components).
- Identify assets and entry points.
- Apply STRIDE per element and per interaction (
references/stride.md).
- Build attack trees for the critical paths (
references/attack-trees.md).
- Score and prioritize (likelihood × impact).
- Extract requirements and map controls (
references/requirements.md, references/mitigations.md).
- Document residual risks; revisit when components, trust boundaries, or data flows change.
The reference tables and templates are material to read and adapt per session, not a library to install.
Gotchas
references/requirements.md Template 1 names 7 compliance frameworks, but Template 3's control-id mapping table only covers PCI DSS, HIPAA, GDPR, and OWASP ASVS. SOC2, NIST CSF, and ISO 27001 have no control-id table anywhere in this skill.
Delegating
For a standalone modeling run, if the threat-modeler agent is installed, spawn it; otherwise follow the Workflow above directly.
1---2name: threat-modeling3description: STRIDE, attack trees, security-requirement extraction, mitigation and control selection, compliance mapping.4---56# Threat Modeling78This threat-models a system's components and data flows, not its code. Pick the one reference the task needs; don't load all four.910| Task | File |11|---|---|12| Identify threats per component/interaction (STRIDE questionnaires, DFD trust-boundary analysis, threat-model doc template) | `references/stride.md` |13| Map attack paths (OR/AND node model, path + coverage analysis, worked account-takeover example) | `references/attack-trees.md` |14| Turn threats into requirements (STRIDE -> requirement patterns, compliance mapping with PCI-DSS/HIPAA/GDPR/OWASP-ASVS control IDs; SOC2/NIST CSF/ISO 27001 have no control-id table) | `references/requirements.md` |15| Choose and prioritize controls (standard-controls library, defense-in-depth layering, coverage + gap analysis) | `references/mitigations.md` |1617## Core Model1819STRIDE categories and the property each violates:2021| Threat | Property violated |22|---|---|23| Spoofing | Authentication |24| Tampering | Integrity |25| Repudiation | Non-repudiation |26| Information disclosure | Confidentiality |27| Denial of service | Availability |28| Elevation of privilege | Authorization |2930Attack trees: root = attacker goal; OR nodes (any child suffices), AND nodes (all children required), leaves = concrete attack steps scored by difficulty, cost, and detection risk. Cheapest complete path = priority defense target.3132Control categories, in layering order: preventive (stop), detective (notice), corrective (recover). Deterrent and compensating controls sit outside that order. A threat counts as covered only when both a preventive control and a detective control apply.3334## Workflow35361. Define scope and trust boundaries.372. Draw the data flow diagram (flows and boundaries, not just components).383. Identify assets and entry points.394. Apply STRIDE per element and per interaction (`references/stride.md`).405. Build attack trees for the critical paths (`references/attack-trees.md`).416. Score and prioritize (likelihood × impact).427. Extract requirements and map controls (`references/requirements.md`, `references/mitigations.md`).438. Document residual risks; revisit when components, trust boundaries, or data flows change.4445The reference tables and templates are material to read and adapt per session, not a library to install.4647## Gotchas4849- `references/requirements.md` Template 1 names 7 compliance frameworks, but Template 3's control-id mapping table only covers PCI DSS, HIPAA, GDPR, and OWASP ASVS. SOC2, NIST CSF, and ISO 27001 have no control-id table anywhere in this skill.5051## Delegating5253For a standalone modeling run, if the `threat-modeler` agent is installed, spawn it; otherwise follow the Workflow above directly.
uwuclxdy