Threat Modeling

NIST describes threat modeling as a form of risk assessment that models the attack and defense sides of a logical entity, such as a piece of data, an application, a host, a system, or an environment. It can be applied to software, applications, systems, networks, distributed systems, IoT devices, and business processes. A threat model typically includes a description of the subject, assumptions that can be checked later, potential threats, actions to mitigate each threat, and a way to validate the model and the actions taken.

The work is often organized around four questions: what are we working on, what can go wrong, what are we going to do about it, and did we do a good job. The model of the system can be a data flow diagram, a use case model, or an architecture diagram that shows all components (users included), the data flows between them, connections to other systems, and trust boundaries. Structured approaches such as the STRIDE mnemonic, attack trees, the MITRE ATT&CK framework, and the cyber kill chain help work out what can go wrong. Threat modeling typically deals with human threat sources rather than natural hazards.

Threat modeling is best applied early, to inform the design and development of a system. Ideally, a high-level model is defined in the concept or planning phase and refined throughout the lifecycle. The NCSC recommends making it business as usual in risk management, development, and CI/CD processes. A model should be updated after events such as a new feature release, a security incident, or architectural or infrastructure changes. Besides the model itself, the effort typically produces a prioritized list of security improvements.