# Threat modeling

> Sitting down before building to ask who could attack this, how, and what to do about it.

- Level: Advanced
- Topics: Security, Software
- URL: https://tidbit.legios.com.ar/threat-modeling/
- In Spanish: [Modelado de amenazas](https://tidbit.legios.com.ar/es/threat-modeling/)

**Threat modeling** is a structured way of thinking like an attacker while a system is still on the whiteboard. A team draws how the system works, where data comes in and goes out, and where one part stops trusting another. Then it asks four plain questions, popularized by security engineer Adam Shostack: what are we building, what can go wrong, what are we going to do about it, and did we do a good enough job?

The drawing matters. Lines that cross a **trust boundary**, like requests from the public internet into your server or from your server into a third-party API, are where most attacks happen. The set of all those entry points is the **attack surface**. To avoid missing whole categories, many teams walk each element through **STRIDE**, a checklist created at Microsoft: Spoofing (pretending to be someone), Tampering (changing data), Repudiation (denying you did something), Information disclosure (leaks), Denial of service, and Elevation of privilege (getting more access than you should).

Each threat found gets a decision: fix it, reduce it, accept it consciously, or move it elsewhere (for example, to a payment provider). The result is a short document that lives next to the design and is revisited when the system changes. It is cheap compared with what it prevents: a missing permission check spotted in a design meeting costs an hour, the same flaw found in production after a breach can cost a company its customers. It also works outside software; journalists and activists build personal threat models to decide which protections are worth the effort for them.

## An analogy

Planning a house with a burglar's eyes before you build it: which windows face the street, where a ladder would reach, which door needs the good lock. Much cheaper than moving a window after the walls are up.

## Keep in mind

- Four questions: what are we building, what can go wrong, what will we do, did we do enough?
- Draw the data flows and trust boundaries; attacks cluster where trust changes.
- STRIDE is a checklist of six threat types to make sure no category is skipped.
- Done at design time and revisited when the system changes, not once and forgotten.

## Go deeper

- [Threat Modeling Manifesto](https://www.threatmodelingmanifesto.org/)
- [Threat Modeling Cheat Sheet (OWASP)](https://cheatsheetseries.owasp.org/cheatsheets/Threat_Modeling_Cheat_Sheet.html)
- [Threat model on Wikipedia](https://en.wikipedia.org/wiki/Threat_model)

## Related terms

- [Internet](https://tidbit.legios.com.ar/internet/): A worldwide network of networks that lets any connected device reach any other.
- [Server](https://tidbit.legios.com.ar/server/): A computer whose job is to answer requests from other computers, all day, every day.
- [API](https://tidbit.legios.com.ar/api/): The menu of things one program lets another program ask for.
- [Microsoft](https://tidbit.legios.com.ar/microsoft/): The company of Windows and Office, now just as much a cloud company with Azure.
- [DDoS](https://tidbit.legios.com.ar/ddos/): Knocking a site offline by flooding it with more traffic than it can handle.
- [Privilege escalation](https://tidbit.legios.com.ar/privilege-escalation/): Going from limited access to more power than you were given, usually by exploiting a flaw.