Threat Modeling

A team built a payment system with encryption, input validation, and MFA. They felt confident. Then an attacker exploited their webhook endpoint. It accepted unverified callbacks. The attacker sent fake "payment successful" webhooks, and the system marked orders as paid without actual payment. The team secured the obvious attack vectors but missed a less obvious one because they never systematically asked "what could go wrong?"

Shopify documented a similar webhook verification gap in their bug bounty program. Uber's 2022 breach started with social engineering of an MFA prompt, a threat vector that traditional application security scanning does not catch. These are not edge cases. They are the kinds of threats that only surface when you sit down and deliberately think about how your system can be attacked.

Threat modeling is the practice of identifying what can go wrong, how likely it is, and what the impact would be. It is not about finding every possible attack. It is about finding the ones that matter most before an attacker does.

Three frameworks dominate threat modeling. Each has different strengths depending on your team and context.

STRIDE (Microsoft, 1999) categorizes threats by type. For each component and data flow in your system, you ask: can someone Spoof identity? Tamper with data? Repudiate actions? Disclose information? Deny service? Escalate privileges? STRIDE is the most widely used because it is simple, memorable, and maps directly to security controls. Microsoft uses it internally and publishes the Threat Modeling Tool based on it.

DREAD scores each threat on five dimensions: Damage potential, Reproducibility, Exploitability, Affected users, Discoverability. Each dimension gets a score from 1-10, and the average gives an overall risk rating. DREAD was popular in the 2000s but fell out of favor because the scoring is subjective. Two engineers rating the same threat will produce different scores.

PASTA (Process for Attack Simulation and Threat Analysis) is a seven-stage methodology that starts from business objectives and works down to technical threats. It is more rigorous than STRIDE but requires more time. PASTA is used in regulated industries (finance, healthcare) where threat modeling needs to produce audit-ready documentation.

For most engineering teams, STRIDE is the right starting point. It is lightweight enough to do in a 2-hour meeting, structured enough to be repeatable, and produces actionable results. Use DREAD-style scoring only when you need to prioritize a long list of STRIDE-identified threats.