Threat modeling: what are you protecting?

Security starts with a list, not with a tool: your assets, who wants them, and what can go wrong.

13 min · 40 XP

You already know how a packet finds its way across the planet and how the OS keeps one process out of another's memory. Security is what happens when that knowledge is used against you. A port scan is just a TCP connection attempt that fails politely. A permission bug is just a file mode you never looked at. This lesson is about the question you ask before touching any of it: what am I protecting, and from whom?

Start with assets — the things that would actually hurt to lose. Not "the server", but: the customer database, the admin account, the backup, the reputation of the shop, the ability to take orders at all. Then ask who wants each one. A bored teenager and a paid criminal want different things from the same site, and you defend differently against each. Then ask how it leaks: not in theory, but by walking the path the data takes.

ASSET            WHO WANTS IT          HOW IT LEAKS
---------------  --------------------  ------------------------------
admin account    anyone, really        password reused on a leaked site
customer emails  spammers, scammers     export endpoint with no auth
server CPU       crypto miners         upload form that runs a script
database backup  competitors           backup file left in a public folderAn asset is only worth defending once you have named who wants it and how they would get it.

A simple checklist keeps you from staring at a blank page. Ask six questions about every part of the system. Can someone pretend to be another user (spoofing)? Can they change data they should only read (tampering)? Can they deny later that they did something, with no record to check (repudiation)? Can they read data they should not see (information disclosure)? Can they make the service unavailable (denial of service)? Can a normal user gain rights they were never given (elevation of privilege)? Six questions, six kinds of bug.

Practice

Match each thing the shop owns with the person most likely to go after it.
Hints
- First decide what could be stolen or broken, then ask who would bother.
- Choose the first thing an attacker would try, not the most exotic one.
14 XP
Your team ships a new page that lists all orders. It works, tests pass, and it is reachable without logging in. What is the real problem?
Hints
- List the things you are protecting and ask what each one is worth.
- A feature that works perfectly is still a problem if everyone can use it.
13 XP
Put the threat modeling steps in the order that actually leads to a fix.
Hints
- Start from what you are protecting, not from the attacker's tricks.
- Fixing comes after you have decided which risk matters enough to fix.
15 XP