Threat Modelling Manfiesto

Introduction

Threat modelling enables security teams to answer four core questions:

  1. What are we working on?
  2. What can go wrong?
  3. What are we doing about it?
  4. Did we do a good job?

This process helps organizations reduce risk, demonstrate due diligence, improve controls, and ensure readiness if a breach occurs.

1. What Are We Working On?

This stage defines context and establishes the scope of the analysis.

Frameworks and Methodologies

Common threat modelling methods include:

  • STRIDE: Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege.
  • OCTAVE: Operationally Critical Threat, Asset, and Vulnerability Evaluation.
  • VAST: Visual, Agile, and Simple Threat modelling.
  • PASTA: Process for Attack Simulation and Threat Analysis.
  • ATASM: Architecture, Threats, Attack Surfaces, Mitigations.
  • MAL: Meta Attack Language.
  • Privacy-driven methods such as LINDDUN.
  • NIST frameworks and industry standards.

Identify High-Value Assets (HVA)

High-value assets include systems, data, applications, and services essential to the organization.

Categorization and prioritization factors:

  • Financial impact
  • Operational impact
  • Regulatory impact
  • Reputation impact
  • Information impact (sensitivity)
  • Physical impact

Assets are assigned scores to determine risk tiers (high, medium, low).

Architecture and Trust Boundaries

Data flow diagrams (DFDs) help visualize:

  • Components
  • Data stores
  • External systems
  • Trust boundaries
  • Data flows

Identifying trust boundaries is essential because attackers often exploit crossing points.

2. What Can Go Wrong?

Determine threats, vulnerabilities, and attacker behavior.

Threat Intelligence

Use sources such as:

  • MITRE ATT&CK
  • AlienVault OTX
  • Industry reporting
  • Open-source threat intelligence feeds

Threat Actors

Examples include:

  • Nation-state actors
  • Cybercriminals
  • Hacktivists
  • Malicious insiders

Mapping actors to motivations and capabilities helps estimate likelihood.

Threat Classification (STRIDE)

Breaks down threats into seven categories:

  • Spoofing
  • Tampering
  • Repudiation
  • Information Disclosure
  • Denial of Service
  • Elevation of Privilege
  • Lateral Movement

Threat Scenarios

These are narrative descriptions of how threats materialize. For example:

  • A malicious actor intercepts data crossing an unencrypted trust boundary.
  • An attacker exploits missing authentication controls.

Factors for Estimating Likelihood

Likelihood is estimated using factors such as:

  • Skill level (capability)
  • Motivation
  • Opportunity
  • Threat actor resources

Vulnerability Factors

Examples:

  • Ease of discovery
  • Ease of exploit
  • Awareness
  • Intrusion detection capabilities

3. What Are We Doing About It?

This phase examines security controls, guidance, and risk mitigation.

Industry Guidance & Standards

Use established frameworks:

  • NIST CSF 2.0
  • ISO 27001
  • CIS Controls
  • Cloud provider frameworks (AWS, Azure, GCP)
  • SCF (Secure Controls Framework)

Tools such as Mappings Explorer help align controls across frameworks.

Risk Assessment

Use structured assessment methods such as NIST 800-30.

Risk components:

  • Damage
  • Reproducibility
  • Exploitability
  • Affected users
  • Discoverability

Controls are evaluated based on:

  • Preventive impact
  • Detective capabilities
  • Corrective mechanisms

Risk categories:

  • Inherent risk
  • Residual risk (after controls)

Attack Mapping

Leverage:

  • MITRE ATT&CK
  • CWE (Common Weakness Enumeration)
  • CVE (Common Vulnerabilities and Exposures)
  • CAPEC (Common Attack Pattern Enumeration and Classification)

Mapping threats to controls identifies gaps and improvement areas.

Risk Mitigation Strategies

Options include:

  • Accept
  • Avoid
  • Transfer
  • Reduce

4. Did We Do a Good Job?

The final stage evaluates the effectiveness of the threat-modelling exercise.

Evaluation Checklist

  • Are threat scenarios realistic and validated?
  • Are controls mapped correctly and aligned to MITRE ATT&CK techniques?
  • Do recommendations reflect actual risks?
  • Have we measured impact and likelihood accurately?
  • Are security improvements implemented?

Continuous Feedback Loop

Threat modelling is iterative. After implementation:

  • Verify control effectiveness
  • Reassess residual risk
  • Update assumptions
  • Re-model when architecture or threat landscape evolves

Guiding Principles

  • No method is perfect; adapt to your environment.
  • Start early in the development or design process.
  • Use intelligence from reputable sources.
  • Focus on practical outcomes.
  • Tailor the approach to your industry and threat landscape.

Conclusion

This guide documents every element from the “Threat Modelling on One Page” diagram to provide a cohesive understanding of how to analyze, identify, and mitigate risk using a structured, industry-supported approach. By following the four core questions and applying relevant frameworks, teams can build defensible and repeatable security practices that align with business priorities.