New answers tagged

7

A threat model answers the question - what are the reasonably expected threats for the concrete software (or "system"). Emphasis on concrete (== not academic/theoretic) and reasonably (== not overbearing, also known as paranoid) A paranoid threat model can (quite literally) paralyze everything (not limited to software). An academic/theoretic threat model ...


46

FilipedosSantos' answer does a great job of explaining a formal threat modelling exercise under, for example, the Microsoft STRIDE methodology. Another great resource is the threat modeling course outline on executionByFork's github. When I use the term "threat model" on this site, I usually mean something less formal. I generally use it as a response to ...


18

A great definition can be found in this excerpt from the OWASP page about Threat Modelling: A threat model is essentially a structured representation of all the information that affects the security of an application. In essence, it is a view of the application and its environment through security glasses. How you make the Threat Model will depend ...


Top 50 recent answers are included