TRACE
Threat modeling
A starter checklist for reasoning about risk before or during the design of a small application.
A small-model workflow
1. Define the system and its purpose2. List valuable data and assets3. Draw components, data flows and trust boundaries4. Identify users, services and other actors5. Ask how confidentiality, integrity or availability could be affected6. Choose proportionate mitigations7. Record assumptions, owners and follow-up work
STRIDE prompts
| Category | Question to ask |
|---|---|
| Spoofing | Could an actor impersonate a user or service? |
| Tampering | Could data or configuration be changed without authorization? |
| Repudiation | Would important actions lack reliable audit evidence? |
| Information disclosure | Could sensitive information reach an unintended party? |
| Denial of service | Could a component be made unavailable or excessively costly? |
| Elevation of privilege | Could an actor gain permissions beyond those intended? |
Record the decision
| Field | Example prompt |
|---|---|
| Asset | What data, service or capability matters? |
| Threat | What unwanted outcome could occur? |
| Existing control | What currently reduces likelihood or impact? |
| Decision | Mitigate, accept, transfer or investigate further? |
| Owner | Who will verify the decision and by when? |
More traces
Questions
What is threat modeling?
It is a structured way to understand what a system protects, how it can be misused and which mitigations are worth prioritizing.
Is specialized software required?
No. A diagram and a clear written record of assumptions, threats and decisions are a useful place to start.