Why it matters
Many serious security problems start in the design: a missing permission check, trust placed in the wrong component, data kept that never needed to be kept. A scanner cannot find a flaw that is in the plan itself. A threat model finds it while it is still a drawing, when fixing it costs a conversation instead of a rewrite.
How it works
A useful session answers four questions: what are we building, what can go wrong, what will we do about it, and did we do enough. In practice the steps look like this.
- Draw the system: users, services, data stores and the lines data crosses between them.
- Mark the trust boundaries, such as the browser to your API or your API to a payment provider.
- List threats at each boundary. Many teams use STRIDE: spoofing, tampering, repudiation, information disclosure, denial of service and elevation of privilege.
- Decide for each threat whether to fix it, reduce it, accept it or pass it to someone else, and write down who owns it.
Keep it small. One hour on one core flow beats a week-long workshop that nobody repeats.
An example
Imagine a clinic booking app. The drawing shows that the patient's browser calls an API with a booking number. Asking what happens if someone changes that number exposes a threat: reading another patient's booking. The fix is a server-side check that the booking belongs to the signed-in user. The same drawing shows that reminders pass through a third-party messaging service, so the team decides to keep medical detail out of the message text. This example is hypothetical.
Common mistakes
- Doing it once and never updating it when the design changes.
- Leaving the people who build the system out of the room.
- Listing threats without owners or decisions.
- Forgetting third-party services, admin tools and backups, which attackers do not forget.
Related terms
Threat modelling feeds secure code review and penetration testing, which check that the decisions were carried out. The OWASP Top 10 is a handy list of what often goes wrong. At Asphaleia every project begins with a threat review; read how we approach threat modelling.