Threat Modelling and Risk

Introduction

You cannot defend against everything, and you do not have unlimited time or money. Threat modelling helps you decide what matters: what are we protecting, who might attack it, how, and what should we do about it? It is thinking, not a tool, and it is most valuable early, before something is built.

The simple explanation

Threat modelling asks four questions: What are we building? What can go wrong? What will we do about it? Did we do a good job?

Step 1: What are we building?

Draw a simple data flow diagram. Show:

Actors: users, admins, other systems
Processes: the web app, the API
Data stores: the database, files
Data flows: arrows showing what moves where
Trust boundaries: lines where trust changes, such as between the internet and your server, or between your app and a third-party service

Most attacks cross a trust boundary, so these are where to look hardest.

Step 2: What can go wrong? STRIDE

STRIDE is a checklist of six threat types, and each is a violation of a security property:

Threat	Violates	Example
Spoofing	Authentication	Logging in as someone else with a stolen token
Tampering	Integrity	Changing the price in a request
Repudiation	Non-repudiation	A user denies a purchase and you have no log
Information disclosure	Confidentiality	A database backup left public
Denial of service	Availability	Flooding the login endpoint
Elevation of privilege	Authorisation	A normal user reaching admin functions

Walk through each element and flow in your diagram and ask which STRIDE letters apply.

Quick quiz

An attacker changes the amount in a payment request before it reaches the server. Which STRIDE category is this?

Step 3: Rank the risks

Risk is the chance something bad happens combined with how bad it would be.

Risk = Likelihood × Impact

A simple way is to rate each from 1 (low) to 3 or 5 (high) and multiply. A likely threat with a huge impact comes first. Rank them so you fix the biggest first, and note that scores are judgement, not science. Be honest about uncertainty.

Step 4: Decide what to do

For each risk, choose a response:

Mitigate: add a control to reduce it, such as MFA, input validation or encryption.
Avoid: remove the feature or data, because data you do not collect cannot leak.
Transfer: share the risk, for example with insurance or a provider.
Accept: knowingly live with it because it is small or too costly to fix. Write it down and have the right person sign off.

Controls should be layered, with defence in depth, so one failure is not a disaster.

Make it a habit

Do it for each significant new feature or system, with developers, testers and operations people together.
Keep the diagram and the list of threats as living documents.
Turn the outcomes into tasks and tests.
Revisit it when the design changes.

Try it yourself

Pick a small system, such as a to-do app with logins. Draw its data flow with trust boundaries, list at least one STRIDE threat for each category, score the three worst, and choose a response for each.

Summary

Threat modelling finds problems early by drawing the system and trust boundaries.
STRIDE gives six types of threat to check at each point.
Rank risks by likelihood and impact, then mitigate, avoid, transfer or accept them, deliberately.