threat-modeling

name	threat-modeling
description	Use when: systematically identify threats to a system and decide how to mitigate them.

Goal: understand what can go wrong before it does, and plan mitigations.

Use for:

• designing a new feature or system with security in mind
• finding attack surfaces and abuse cases
• prioritizing security work by risk

Workflow:

1. Diagram the system: components, data flows, and trust boundaries.
2. Identify assets worth protecting and who might attack them.
3. Enumerate threats per element (e.g. with STRIDE).
4. Rate each by likelihood and impact.
5. Decide to mitigate, accept, transfer, or eliminate.
6. Track mitigations as concrete, testable work.

STRIDE prompts:

• Spoofing, Tampering, Repudiation
• Information disclosure, Denial of service
• Elevation of privilege

Rules:

• model around data flows and trust boundaries
• focus effort on high-likelihood, high-impact threats
• record accepted risks explicitly, with rationale
• turn mitigations into verifiable tasks, not intentions