Introduced at Microsoft by Loren Kohnfelder and Praerit Garg (The Threats to Our Products, 1999), described by Michael Howard and David LeBlanc (Writing Secure Code, second edition), and set out in full by Adam Shostack (Threat Modeling, 2014).
Checks each part of a system against six threat types, spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege, and produces a ranked threat list.
When to reach for it
When a software system, product feature, or data flow needs a security review that covers every category of threat, beyond the ones someone happens to imagine.
How it runs
- Draw a data-flow diagram with its trust boundaries.
- Walk each component through the six threat types.
- Record each threat found with its severity.
- Assign a mitigation to each threat.
- Rank the list and track the fixes.
Where it sits in SOLVE eX
Go to the source
- The Threats to Our Products, Microsoft internal memo, 1999
- Writing Secure Code, second edition, 2002
- Threat Modeling: Designing for Security, 2014