threat-modeling

Threat Modeling

Applicable Scenarios

• Security design review for new features
• Security assessment for new system architecture
• Security analysis before major changes
• Threat analysis required for compliance

Core Principles

1. 在设计阶段做（不是上线后）
2. STRIDE 六类威胁全覆盖
3. 关注数据流（不只是组件）
4. 输出可操作的缓解措施
5. 定期更新（架构变更时）

STRIDE Model

Threat	Meaning	Example	Mitigation
Spoofing	Spoofing	Forging JWT	Signature verification + expiration
Tampering	Tampering	Modifying request body	Signature + validation
Repudiation	Repudiation	Denying operations	Audit logs
Information Disclosure	Information Disclosure	Logs containing passwords	Masking + encryption
Denial of Service	Denial of Service	Massive requests	Rate limiting + CDN
Elevation of Privilege	Elevation of Privilege	Regular user changes to admin	RBAC + validation

Workflow

1. 画数据流图（DFD）
   - 外部实体 / 进程 / 数据存储 / 数据流
   ↓
2. 识别信任边界
   - 前端 ↔ 后端
   - 后端 ↔ 数据库
   - 内部 ↔ 第三方
   ↓
3. 对每个数据流应用 STRIDE
   ↓
4. 评估风险（概率 × 影响）
   ↓
5. 制定缓解措施
   ↓
6. 输出威胁模型文档

Supporting Templates

• templates/threat-model-template.md — DFD + STRIDE analysis + mitigation measures

Quality Self-Check

□ DFD 完整（所有数据流）
□ 信任边界标注
□ STRIDE 六类全覆盖
□ 风险评估有依据
□ 缓解措施可执行
□ 与开发团队评审过

Common Pitfalls

1. Only looking at components, not data flows——missing transport layer threats
2. Not marking trust boundaries——not knowing where validation is needed
3. Mitigation measures too abstract——"strengthen security" is not actionable
4. Not updating after completion——architecture changed but the model did not
5. Not reviewing with development——development does not know what to do

Collaboration with Other Skills

下游：
  code-security-review → 按威胁模型重点审查
  web-vulnerability → 按威胁模型重点测试
  auth-security-audit → 权限提升威胁
  security-report → 威胁模型作为报告输入