Template preview · Software
Threat model
Identify credible threats and choose proportionate mitigations.
A threat model for a bounded fictional system change.
Sample purpose
Identify credible threats and choose proportionate mitigations.
Audience: Security engineer, Technical lead- Structure
- 4 sections
- Criteria
- 12
- Sources
- 10
- Watches
- 5
- Default approach
- Review first
Set the purpose first. Then change every section, criterion, and agent setting before anything runs.
Fictional sample
Structure and criteria
Sample content shows the shape of a useful document. Copying it is optional.
01 Review firstSystem scope
Describe assets, actors, and trust boundaries.
Criteria
- Names a specific protected asset, e.g. note contents and share tokens
- Names an external trust boundary, such as the public browser-to-API request
- Lists actors, including an attacker with network access
Sources
- OWASP Threat Modeling Cheat Sheet cheatsheetseries.owasp.orgScope, data flows and trust boundaries.
- Northstar Notes API spec (fictional) api.northstarnotes.exampleEndpoints and access patterns for shared links.
Sample content
Northstar Notes shares a document through an unguessable link. Protected assets are note contents and access tokens; the boundary is the public browser-to-API request.
02 Review firstThreat inventory
Record threats as attacker action plus harmed outcome.
Criteria
- Each threat gives actor, action and asset, not a vulnerability label
- Likelihood and impact are both rated
- At least one threat uses a boundary named in system scope
Sources
- MITRE ATT&CK attack.mitre.orgAdversary techniques to test the threat list against.
- CAPEC capec.mitre.orgAttack patterns for link and token guessing.
- CISA Known Exploited Vulnerabilities cisa.govExploited issues to weigh likelihood.
Watches
- Follows System scope
- Checks cisa.gov weekly
Agent may read attack.mitre.org, capec.mitre.org, cisa.gov.
Sample content
Threat Impact Priority Leaked link forwarded to an unintended reader Confidential note disclosure High Token enumeration attempts Unauthorized document access Medium 03 ManualMitigations
Make controls testable and owned.
Criteria
- Each mitigation names the threat it addresses
- Verification is a test someone other than the owner can run
- At least one mitigation records the residual risk
Sources
- OWASP Secure Coding Practices owasp.orgToken generation and session handling requirements.
- CWE Top 25 cwe.mitre.orgCommon weaknesses and fixes.
- Northstar Notes controls inventory (fictional) controls.northstarnotes.exampleControls already in place, with test results.
Watches
- Follows Threat inventory
Sample content
- ☑ Use high-entropy tokens; verify generation test
- ☑ Add revoke action; verify link stops resolving
- ☑ Document forwarding remains residual user risk
04 Review firstReview status
Keep review coverage and unresolved risks visible.
Criteria
- Names the reviewer and a review date within 90 days
- States high-priority threats mitigated as a ratio
- Each accepted risk names who accepted it
Sources
- NIST SP 800-39 csrc.nist.govRisk acceptance and approval roles.
- Northstar Notes review calendar (fictional) reviews.northstarnotes.exampleReview dates and assignees.
Watches
- Follows Threat inventory
- Follows Mitigations
Sample content
- High-priority threats mitigated
- 1 of 1
- Accepted residual risks
- 1