Threat Modeling - PLAN

Positioning DevSecOps in Your Lifecycle

Security Visibility and Control

Threat Modeling

Threat modeling is a process by which potential threats, such as structural vulnerabilities, can be identified, enumerated, and prioritized – all from a hypothetical attacker’s point of view.

There are many different Threat Modeling methodologies. One of the more common is known as STRIDE.

S - Spoofing

T - Tampering

R - Repudiation

I - Information disclosure / leakage

D - Denial of service

E - Elevation of privilege

These are all different threats that you should assess your application to ensure it is robust enough to defend against them.

It's always better to use some specific tools that are designed specifically for the process. It's quite difficult to do manually. Implementing tooling can help you identify the threats quickly. One freely available tool is Microsoft Threat Modelling Tool (https://docs.microsoft.com/enus/ azure/security/develop/threat-modeling-tool).