There are at least three different common approaches to creating a threat model:

  • Attacker-centric
  • Software-centric
  • Asset-centric

You can take a look at Wikipedia for a quick overview.

I wonder if one of those approaches has proven to be superior in general or if you have to choose them depending on the situation at hand. I have experience with all three of them and I personally prefer the attacker-centric approach because it feels straight forward and it fits my way of thinking. I can see the benefits of the asset-centric approach, especially if you want to see the business impact of certain threats directly. The software-centric approach feels clumsy and heavy-weight to me. If you want to drill in really deep and have a lot of time at hand for threat modeling it might be a good option though.

These are just my personal experiences. Is there an approach that has has proven to be superior in general or do you have to choose them depending on the situation at hand? Is there a common understanding about that in the Security Community.

2 Answers 2


Does Threat Modeling have to be confined to one of those approaches? A hybrid approach might be better suited to meeting your security goals.

On the one hand you can measure the risk to your assets and in combination with a software centric approach, get your development teams to follow development best practices.

  • On a side note, what do you see as challenges to traditional threat modeling approaches? Any testimonials with measurable results to a specific approach or methodology?
    – Epoch Win
    Commented Jan 30, 2012 at 21:11

I prefer asset-centric approach. It works best for me, it usually easy to identify system assets and then to do threat analysis for each asset.

But whatever works for you (and your manager)



You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .