threat-modeling

What this skill does

# Threat Modeling

Systematic approach to identifying, quantifying, and addressing security threats in software systems.

## When to Use This Skill

**Keywords:** threat modeling, STRIDE, DREAD, attack trees, security design, risk assessment, threat analysis, data flow diagram, trust boundary, attack surface, threat enumeration

**Use this skill when:**

- Designing new systems or features
- Conducting security architecture reviews
- Identifying potential attack vectors
- Prioritizing security investments
- Documenting security assumptions
- Integrating security into SDLC
- Creating threat models as code

## Quick Decision Tree

1. **Starting a threat model?** → Begin with [Threat Modeling Process](#threat-modeling-process)
2. **Identifying threats?** → Use [STRIDE methodology](#stride-methodology)
3. **Prioritizing threats?** → Apply [DREAD scoring](#dread-risk-scoring) or [Attack Trees](#attack-trees)
4. **Automating threat models?** → See [references/threat-modeling-tools.md](references/threat-modeling-tools.md)
5. **Specific architecture patterns?** → See [Architecture-Specific Threats](#architecture-specific-threats)

## Threat Modeling Process

```text
┌─────────────────────────────────────────────────────────────────┐
│                    THREAT MODELING WORKFLOW                      │
├─────────────────────────────────────────────────────────────────┤
│                                                                  │
│  1. DECOMPOSE        2. IDENTIFY         3. PRIORITIZE          │
│  ┌──────────┐       ┌──────────┐        ┌──────────┐           │
│  │ System   │──────▶│ Threats  │───────▶│ Risks    │           │
│  │ Model    │       │ (STRIDE) │        │ (DREAD)  │           │
│  └──────────┘       └──────────┘        └──────────┘           │
│       │                   │                   │                  │
│       ▼                   ▼                   ▼                  │
│  ┌──────────┐       ┌──────────┐        ┌──────────┐           │
│  │ DFD      │       │ Attack   │        │ Counter- │           │
│  │ Trust    │       │ Trees    │        │ measures │           │
│  │ Boundary │       │ Patterns │        │ Backlog  │           │
│  └──────────┘       └──────────┘        └──────────┘           │
│                                                                  │
│  4. DOCUMENT ──────▶ 5. VALIDATE ──────▶ 6. ITERATE            │
│                                                                  │
└─────────────────────────────────────────────────────────────────┘
```

### Step 1: System Decomposition

Create a Data Flow Diagram (DFD) with these elements:

| Element | Symbol | Description |
|---------|--------|-------------|
| External Entity | Rectangle | Users, external systems |
| Process | Circle | Code that transforms data |
| Data Store | Parallel lines | Databases, files, caches |
| Data Flow | Arrow | Data movement |
| Trust Boundary | Dashed line | Security perimeter |

```csharp
// Example: E-commerce system decomposition
public enum ElementType
{
    ExternalEntity, Process, DataStore, DataFlow
}

/// <summary>Defines a security perimeter</summary>
public sealed record TrustBoundary(
    string Id,
    string Name,
    string Description,
    IReadOnlyList<string> Elements);  // IDs of contained elements

/// <summary>Data Flow Diagram element</summary>
public sealed record DfdElement
{
    public required string Id { get; init; }
    public required string Name { get; init; }
    public required ElementType ElementType { get; init; }
    public string? TrustBoundary { get; init; }
    public string Description { get; init; } = "";
}

/// <summary>Connection between elements</summary>
public sealed record DataFlow
{
    public required string Id { get; init; }
    public required string Source { get; init; }
    public required string Destination { get; init; }
    public required string DataType { get; init; }
    public required string Protocol { get; init; }
    public bool Encrypted { get; init; }
    public bool Authenticated { get; init; }
}

/// <summary>Complete system model for threat analysis</summary>
public sealed class SystemModel(string name)
{
    public string Name => name;
    private readonly Dictionary<string, DfdElement> _elements = new();
    private readonly List<DataFlow> _flows = [];
    private readonly List<TrustBoundary> _trustBoundaries = [];

    public IReadOnlyDictionary<string, DfdElement> Elements => _elements;
    public IReadOnlyList<DataFlow> Flows => _flows;
    public IReadOnlyList<TrustBoundary> TrustBoundaries => _trustBoundaries;

    public void AddElement(DfdElement element) => _elements[element.Id] = element;
    public void AddFlow(DataFlow flow) => _flows.Add(flow);
    public void AddTrustBoundary(TrustBoundary boundary) => _trustBoundaries.Add(boundary);

    /// <summary>Identify flows that cross trust boundaries - high-risk areas</summary>
    public IReadOnlyList<DataFlow> GetCrossBoundaryFlows()
    {
        var crossBoundary = new List<DataFlow>();
        foreach (var flow in _flows)
        {
            var sourceBoundary = _elements[flow.Source].TrustBoundary;
            var destBoundary = _elements[flow.Destination].TrustBoundary;
            if (sourceBoundary != destBoundary)
                crossBoundary.Add(flow);
        }
        return crossBoundary;
    }
}

// Example usage
var model = new SystemModel("E-Commerce Platform");

// Define elements
model.AddElement(new DfdElement
{
    Id = "user",
    Name = "Customer",
    ElementType = ElementType.ExternalEntity,
    TrustBoundary = "internet",
    Description = "End user accessing via browser"
});

model.AddElement(new DfdElement
{
    Id = "web_app",
    Name = "Web Application",
    ElementType = ElementType.Process,
    TrustBoundary = "dmz",
    Description = "Frontend web server"
});

model.AddElement(new DfdElement
{
    Id = "api",
    Name = "API Gateway",
    ElementType = ElementType.Process,
    TrustBoundary = "internal",
    Description = "Backend API services"
});

model.AddElement(new DfdElement
{
    Id = "db",
    Name = "Database",
    ElementType = ElementType.DataStore,
    TrustBoundary = "internal",
    Description = "Customer and order data"
});

// Define flows
model.AddFlow(new DataFlow
{
    Id = "f1",
    Source = "user",
    Destination = "web_app",
    DataType = "HTTP Request",
    Protocol = "HTTPS",
    Encrypted = true,
    Authenticated = false
});

// Find high-risk flows
var riskyFlows = model.GetCrossBoundaryFlows();
```

## STRIDE Methodology

STRIDE is a threat classification framework for systematic threat identification:

| Category | Threat | Security Property | Example |
|----------|--------|-------------------|---------|
| **S**poofing | Impersonating someone/something | Authentication | Stolen credentials, session hijacking |
| **T**ampering | Modifying data or code | Integrity | SQL injection, file modification |
| **R**epudiation | Denying actions | Non-repudiation | Missing audit logs |
| **I**nformation Disclosure | Exposing information | Confidentiality | Data breach, verbose errors |
| **D**enial of Service | Disrupting availability | Availability | Resource exhaustion, DDoS |
| **E**levation of Privilege | Gaining unauthorized access | Authorization | Privilege escalation, IDOR |

### STRIDE-per-Element Analysis

Apply STRIDE to each DFD element:

```csharp
using System.Collections.Frozen;

public enum StrideCategory
{
    Spoofing, Tampering, Repudiation, InformationDisclosure, DenialOfService, ElevationOfPrivilege
}

/// <summary>Which STRIDE categories apply to which element types</summary>
public static class StrideApplicability
{
    public static readonly FrozenDictionary<ElementType, StrideCategory[]> Map =
        new Dictionary<ElementType, StrideCategory[]>
        {
            [ElementType.ExternalEntity] =
                [StrideCategory.Spoofing, StrideCategory.Repudiation],
            [ElementType.Process] =
                [Str