EDUCATION, THEAT MODELING, STRIDE

🧭 Danger Modelling - how to find weak places before they find an attacker

Seven chapters on threat modelling in international practice: four questions (Threat Modeling Manifesto), a system model with trust limits, STRIDE, attacks on an online store step by step, risk action, methods and tools, relation to NIS2 and standards. Examples are fictional, designed for training.

Four questions

What is threat modelling and why do it

Trouble modelling is a structured way to find what can go wrong in the system even before it is found by an attacker. This is done during the design, when the correction of the error is cheaper than after the start-up, and repeated when the system changes.

Four questions Threat Modeling Manifesto

1. What are we building?What are we working on?system model: parts, data, flow and reliability limits
2. What can go wrong?What can go wrong?threat list, e.g. after STRIDE for each element
3. What are we gonna do?What are we going to do about it?action for each threat: prevent, mitigate, transfer or accept
4. Did we do enough?Did we do a good enough job?verification that the measures have been implemented and the model complies with the system

When to model

For a new systemduring design, before code
Substantial changenew function, integration, cloud, other supplier
Pre-startverification that the threat found has been processed
After incidentwhat model didn't notice and why

Who is participating

Developers and architect, who knows the system, product owner, who knows the business value, operations team and security specialist. The best threat lies in a conversation, not in a personal document.

Manifest values

Finding and correcting design errors is more important than matching ticks; people and cooperation - about tools; understanding - about a one-off snapshot; doing - about talking; constant improvement - about one contribution.

Result

Not a thick document, but a list of specific threats and tasks that come into the development work list like any other work.

Most frequent error

Start with a tool or template rather than with the question what the system does. A model that no one renews describes a different system after six months.

What are we building?

System model - limits of data flow and reliability

The first question - what we are creating - answers with a data flow diagram (DFD). In the example there is a small online store. The abandoned line is the limit of reliability: the place where data shift from one level of trust to another. That is where the most common threat is.

Buyer → Web app: login and order.
Web application ↔ payment service: payment request and confirmation.
Web application → Order database: orders and customer data.
Administrator → admin panel: login and content change.
Admin panel → order database: corrections.
Admin panel → logs: what and when changed.

DFD elements
Element	As a drawing	What It means	Example:
External side	As a drawingrectangle	What It meansperson or system you don't control	Example:buyer, payment service
Process	As a drawingcircle	What It meanscode processing the data	Example:web application, admin panel
Data repository	As a drawingtwo parallel lines	What It meansplace where the data are stored	Example:database, logs, file folder
Data flow	As a drawingarrow	What It meansdata moving between elements	Example:order, confirmation of payment
Reliability limit	As a drawingaborted line	What It meansplace where the degree of trust or ownership changes	Example:internet - server - internal network

Scope

Before drawing, write down what is in the model and what is not. One sheet for one system - if the scheme does not include, the distribution of it.

Key assets

What would be the worst if it were to fall into the wrong hands or disappear? For the website, these are usually customer data, login data, payment flow and administrator access.

Entry points

Each location where data enters the system: forms, API, file upload, administration panel, integration. The attacker starts right there.

What can go wrong?

STRIDE - six types of threats

The second question is, what can go wrong. STRIDE is a reminder developed by Microsoft about six types of threats. Each is the opposite of a safety feature, so when you go through all six, no class of threats is forgotten.

STRIDE threat types
Type of threat	What happens	Impairment	Example:	Typical controls
S Forgery of identitySpoofing	What happenssomeone pretends to be another user or system	Impairmentauthenticity	Example:attacker login with leaked administrator password	Typical controlsstrong authentication, MFA, safe session
T Violation of dataTampering	What happensdata, code or configuration are changed without permission	Impairmentintegrity	Example:the buyer in the browser replaces the price of the goods before the order	Typical controlsserver verification, signatures, access rights
R ExclusionRepudiation	What happenssomeone denies the action and cannot prove it	Impairmentirrevocability	Example:client claims that the order was not	Typical controlsnon-system audit logs, time stamps
I Release of informationInformation disclosure	What happensdata reaches someone who should not see them	Impairmentconfidentiality	Example:error page shows database query	Typical controlsencryption, access control, errors without details
D Service failureDenial of service	What happenssystem becomes unavailable or slow	Impairmentavailability	Example:robot floodes the login form	Typical controlsrequest limits, CDN, scale
E EnforcementElevation of privilege	What happensthe user acquires more rights than he is entitled to	Impairmentauthorisation	Example:normal buyer opens administration function	Typical controlsverification of rights in each application, minimum rights

STRIDE by element type

Not every type of threat fits every element. Microsoft's table tells who to ask - it shortens the work and doesn't skip anything.

Which threats of STRIDE fit the DFD element
Element	S	T	R	I	D	E
External side	S✓	T-	R✓	I-	D-	E-
Process	S✓	T✓	R✓	I✓	D✓	E✓
Data repository	S-	T✓	Rfor magazines	I✓	D✓	E-
Data flow	S-	T✓	R-	I✓	D✓	E-

How to use

Only the questions indicated in the table are asked for each element and each flow. Flows crossing the limit of reliability are examined first.

Limit

STRIDE finds design threats, but not everything: business logic errors and privacy risks are better found with additional questions or LINDDUN.

The Attacker's View

Online shop step by step

The same shop with the eyes of the attacker. Go through the steps: each is one type of STRIDE threat and a green note - a control that stops it.

Six Threats to One Site

Each step - one STRIDE letter. Check if your site has this control.

Internet Store Attacks

1
Attacker → Shoplogin with leaked password
Control: MFA, limited login attempts
S - identity fraud: the attacker pretends to be a legitimate user.
2
Attacker → Shoporder with price 0,01 €
Control: price calculation server, not browser
T - Misrepresentation of data: Data coming from a browser is under user control, so it does not trust them.
3
ShopThe client says I didn't make this order.
R - Denial of activity: without a log it cannot prove what happened. Control: Log with time, account and confirmation, stored outside the server.
4
Shop → Attackererror page with database query
Control: user short notice, details in log only
I - Release of information: The page itself reveals how the system is built.
5
Attacker → Shop10,000 login attempts per minute
Control: demand limits, network edge protection (CCN, WAF)
D - Service failure: the site is overloaded and real buyers are not in.
6
Attacker → Shop/admin/ with ordinary buyer account
Control: rights checked by the server in each request
E - rights increase: the usual user obtains the administrator's capabilities.
7
NoteSix questions for each element - and no threat class is forgotten.
Control of each threat found becomes a task development work list.

What are we gonna do?

Risk, conduct and verification

The third question is what we will do. Each threat shall be assessed at risk (reliable and how serious) and at risk. How to assess the risk is more detailed in the next roadmap - risk analysis.

1. PreventEliminatechange the design or refuse to function so that the threat is no longer
2. ReduceMitigateintroduce controls that reduce the likelihood or effect
3. TransferTransferliability assumed by another supplier or insurer
4. AcceptAcceptknowingly living at risk, with justification and decision of the responsible person

How to record one threat

Example of a radar recording
Field	Example
Where	Exampleflow 1: buyer → web application
STRIDE	ExampleS - identity fraud
Threats	Examplean attacker logs in with a password flooded on another site
Hazard	Exampleprobability of high, impact medium - high
Action	Examplereduce: MFA and login attempts limit
Responsible and deadline	Exampledevelopment command, next release
How to Check	Exampletest receiving blockage after five incorrect passwords

Did we do enough?

✓ Threats assessed for each border flow
✓ Every threat has action and responsibility
✓ Management confirms accepted high risks
✓ Control checked test, not promise
✓ The model meets what really works

DREAD

In the past, Microsoft used the DREAD score, but refused it - ratings were too subjective. A simple possibility and effect or CVSS for specific injuries is used today.

Working list

Threats that remain in the document are not corrected. Every action becomes a task with responsibility, as well as an error correction.

Comparison

Methods and tools

Danger modelling methods
Method	What you're looking at	When to Choose
STRIDE	What you're looking atdesign threat by system elements (Microsoft, 1999)	When to Choosedevelopment team - a simple start for any system
PASTA	What you're looking atseven steps from business goals to attack simulation (UcedaVélez, Morana)	When to Choosewhen to link the threat to business impact and risk
LINDDUN	What you're looking atprivacy threats: interlinkability, identification, data disclosure, etc. (KU Leuven)	When to Choosesystems with personal data, together with GDPR
Attack trees	What you're looking atone attacker's target divided into steps (Schneier, 1999)	When to Choosewhen to understand how to achieve a specific objective directly
OCTAVE	What you're looking atorganisation level risks and assets (CERT, Carnegie Mellon)	When to Chooseorganisation, not a single application
VAST	What you're looking atlarge scale, single applications and infrastructure modelling	When to Chooselarge organisations with many teams
MITRE ATT&CK	What you're looking atreal attacker techniques, not design	When to Choosewhen to check detection and protection against known techniques

Tools

Whiteboard or paperenough for the first model - talk is more important
OWASP Three Dragonfree, open-source, DFD and STRIDE
Microsoft Thread Modeling Toolfree, Windows, STRIDE by elements
OWASP pytmmodel as code, generates DFD and threat list

In combination

The methods need not be chosen once and for all: STRIDE for design, LINDDUN for personal data, ATT&CK for protection verification.

Tool is not a model

The tool helps to write down, but threats are found by people who understand the system. Start with the conversation and the whiteboard.

References

Standards and NIS2

Where threat modelling requires or recommends
Source	What they say
NIS2 article 21	What they sayParagraph 2 (a) requires a risk analysis policy, paragraph (e) security in purchasing, developing and maintaining systems. The threat model is a way of justifying why these measures have been chosen.
NIST SSDF (SP 800-218)	What they sayPW.1.1 - Use risk modelling, such as threat modelling, to assess software security risk.
OWASP SAMM	What they saypractice Three Assessment in design - from simple models to regular, standardised modelling.
ISO/IEC 27001:2022	What they sayA.8.25 Life cycle of safe development and principles of safe system architecture.
Microsoft SDL	What they saythreat modelling is a mandatory design step.
CISA Secure by Design	What they saythe manufacturer is responsible for the safety in design, not the user afterwards.

References

This Modelling Manifesto 2020, A. Shostack - Threat Modeling: Designing for Security (2014), OWASP Thread Modeling Cheat Sheet, NIST SP 800-154 (project 2016).

Relationship with other roadmaps

Risk assessment and treatment - risk analysis, DFD and C4 - system modelling, security gate development - safe development.

Abbreviations

Abbreviations used in the Roadmap: the original name and what it means.

DFD: Data Flow Diagram - a diagram showing the parts of the system and the data flows between them.
STRIDE: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege - Six types of threats developed by Microsoft.
PASTA: Process for Attack Simulation and Threat Analysis - a risk-based seven-step method.
LINDDUN: Privacy Threat Method (KU Leuven).
OCTAVE: Operationally Critical Threat, Asset, and Vulnerability Evaluation - method of risk assessment at organisation level.
VAST: Visual, Agile and Simple Threat modeling - large scale threat modelling.
MFA: Multi-Factor Authentication - login with more than one proof, such as password and code.
CDN: Content Delivery Network - a network of servers that delivers the site closer to the user and perceives overload.
WAF: Web Application Firewall - the firewall of web applications.
API: Application Programming Interface - the interface through which the programmes exchange data.
DREAD: An earlier Microsoft risk point scale, which was discarded.
CVSS: Common Vulnerability Scoring System - assessment of vulnerability from 0 to 10.
NIS2: EU Directive (EU) 2022/2555 on cyber security.
SSDF: Secure Software Development Framework - NIST secure software development framework (SP 800-218).
SAMM: Software Assurance Maturity Model - OWASP is a mature model of safe development.
SDL: Security Development Lifecycle - Microsoft safe development process.
OWASP: Open Worldwide Application Security Project - a non-profit community for the safety of web applications.
ATT&CK: MITRE knowledge base on real attackers tactics and techniques.
GDPR: General Data Protection Regulation - General Data Protection Regulation.