Threat modeling is a process that can help developers identify and understand potential security risks in applications and websites.
The threat modeling guide describes how to perform threat modeling. It provides a lightweight overview of the threat modeling process, focusing on the four key questions as defined in the Threat Modeling Manifesto.
This article describes the STRIDE and LINDDUN frameworks, which provide structure for threat modeling processes, along with additional resources.
Frameworks and techniques exist that can help you to think about threats from different perspectives. They can help you to explore structured answers to the four threat modeling questions, in particular to the key question "What can go wrong". They do this by offering threat categories.
You can reference these categories in your threat model (for example, "STRIDE: Tampering") to indicate that you thought about a known threat framework category.
Two popular threat analysis frameworks are STRIDE, which focuses on security, and LINDDUN, which focuses on privacy.
The STRIDE framework is a widely recognized threat modeling method developed by Microsoft. Each letter in the STRIDE acronym represents one of the six security threat categories. Within each category we've included relevant questions that you can include in your threat model.
Impersonating another user or system to gain unauthorized access, such as an attacker faking a login user interface to steal user credentials.
Unauthorized modification of data or systems, such as changing a hidden input field in a checkout form.
Claiming not to have performed an action, such as a user deleting data and having no deletion audit trail.
Unauthorized exposure of confidential information, such as pushing sensitive environmental values to production.
Disrupting services to make them unavailable, such as client-side infinite loops that can freeze the browser or infinite requests that can bog down the server.
Gaining higher access rights than allowed, such as a user impersonating an admin.
The LINDDUN framework is a widely recognized threat modeling framework, inspired by STRIDE, that focuses on data privacy threats. Each letter in the LINDDUN acronym represents one of the seven categories of privacy threats. Within each threat model category, we've included questions you can include in your threat model relevant to the listed category.
The ability to associate data or actions to an individual or group.
Learning the identity of an individual.
The ability to link or attribute a claim (or action) to an individual.
Determining the involvement of an individual based on observation.
Collecting more information than needed, storing, processing, or sharing, personal data.
Insufficiently informing, involving or empowering individuals in the processing of personal data.
Deviation from security and data management best practices, standards and legislation.
The following documents list a broad and diverse set of threats and threat models for your consideration:
An effective model is one that helps develop a better understanding of your system. Threat modeling tools can make it easier to create diagrams, visualize data flows, and so on, that contribute to this goal.
It is important to note that you do not need expensive and powerful tools in order to create an effective threat model. What is important is the methodical approach and discussion around your system. Overly complex diagrams can actually be detrimental if they don't promote and support that discussion.