Security Engineering · Cluster
Threat Modeling
Assets, adversaries, and attack trees.
- 01 Trust Boundaries in Data Flow Diagrams and Where Threats Localize How a data flow diagram encodes trust as lines rather than prose, why a boundary is only real where a principal loses authority, and how moving one line changes the entire threat list.
- 02 Assets as Security Properties Rather Than Components Why an asset inventory keyed by server names produces useless threat lists, how to decompose a system into confidentiality, integrity, and availability assets, and what ownership of each asset implies.
- 03 Adversary Capability Models and the Assumptions They Encode How an attacker profile is really a list of things the attacker cannot do, why network position and time budget dominate the labels, and where capability tiers mislead.
- 04 Attack Tree Semantics: AND/OR Nodes and the Cost of the Cheapest Path How attack trees represent alternative and conjunctive attacker actions, how cost and probability propagate through the two node types, and why the cheapest path is rarely the most likely one.
- 05 Applying STRIDE per Element Instead of per System Why the six threat classes are property violations, which of them are vacuous for each diagram element type, and how the per-element grid turns a mnemonic into an assignable work list.
- 06 Attack Graphs, Shared Subgoals, and Shortest Paths Through State Space How an attack graph differs from an attack tree, why shared subgoals force a DAG, and how monotone reachability analysis computes the closure of what an attacker can obtain.
- 07 DREAD Scores and Why Ordinal Risk Ratings Do Not Multiply What the five DREAD dimensions actually ask, why averaging ordinal ranks produces a number with no meaning, and how to replace the arithmetic with a comparison that survives review.
- 08 Attack-Defense Trees and Countermeasure Selection as a Two-Player Problem How adding defender nodes changes attack tree semantics from satisfiability to a game, what min-max evaluation computes, and why the defender moving first or second changes the answer.
- 09 Attack Nets, Concurrency, and the State-Space Explosion How Petri-net attack models represent parallel attacker actions and partial progress, why the reachability graph grows faster than exponentially, and which reductions keep analysis tractable.
- 10 Keeping a Threat Model Current When the System Changes How to bind threats to the artifacts that encode their assumptions, what invalidates a model silently, and how diffing architecture against model finds the stale entries before an audit does.