Threat modeling with a whiteboard
You do not need a complicated framework to ask good questions about how a feature could fail.
Start with what you are protecting and where trust changes.
The working idea
Start with what you are protecting and where trust changes.
The goal is not to guess the answer faster. It is to make a decision that another person can understand and repeat.
What to check
Sketch people, services, data stores, and arrows. Mark boundaries where identity or permission changes. Ask what could go wrong at each crossing.
The goal is not to guess the answer faster. It is to make a decision that another person can understand and repeat.
A realistic example
A file-upload feature crosses a boundary when a visitor-controlled file reaches application storage. Consider type checks, size limits, and access controls.
Good security work usually becomes visible through notes, tests, and the questions you decide to ask next. Keep the first iteration small.
What to avoid
Do not start with a list of fashionable attack names and retrofit the design to match.
Good security work usually becomes visible through notes, tests, and the questions you decide to ask next. Keep the first iteration small.
Draw one feature of your own project and mark two trust boundaries.
Good security work usually becomes visible through notes, tests, and the questions you decide to ask next. Keep the first iteration small.
