Threat Modeling

Threat modeling is a structured process for identifying how an attacker might target a system — before the system is built.

A good threat model asks: What are we building? What could go wrong? What are we doing about it? Did we do a good job?

Threat modeling shifts security thinking left — from reactive fixing to proactive design. Products that are threat modeled before code is written, and continuously after, have a better chance at preventing exploitable weaknesses.

Discussion prompts

• When in your development process do you threat model? Is threat modeling a phase, or a continuous process?
• What part of your system would you most want an attacker NOT to find — and have you modeled it?
• When your products are compromised, how do you update your threat models?