Threat Modeling

Definitions

1. A structured process for identifying security threats, attack vectors, and mitigations during the design phase — before code is written. Common frameworks: STRIDE (Spoofing, Tampering, Repudiation, Information Disclosure, DoS, Elevation of Privilege), DREAD (risk scoring), and attack trees. Much cheaper to fix threats in design than in production.

   In plain English: Systematically thinking about how attackers could break your system before you build it, so you can design in defenses.

   Example: "The threat model identified that the webhook endpoint has no authentication — adding HMAC verification now is cheaper than after a data breach."

Related Terms

• Threat Model
• Authentication
• OTP
• CORS Preflight
• DAST
• RFC Process
• API Key vs Token
• Anti-Forensics
• Anti-Malware
• Bluetooth Sniffing
• Business Email Compromise
• Email Bombing
• ICMP Tunneling
• IDS Evasion
• Log Forging
• Log Tampering
• Request for Comments