A threat model is a structured way to understand, prioritize, and manage threats to a system. It adopts an attacker’s perspective to identify vulnerabilities, evaluate their effects, and select mitigation strategies. Begin during design, then revisit it as the system, environment, and known vulnerabilities change. section 8.1
Use AI as a brainstorming partner, not a security authority. Describe the system and its architecture, ask for likely threats, drill into specific attack paths, assess risk, and request countermeasures. Refine the discussion as details emerge, then cross-check results against current authoritative security guidance because AI lacks real-time threat intelligence. section 8.1.2 section 8.0
A practical threat-modeling pass can:
- Identify a growing attack surface created by digital services, cloud infrastructure, microservices, third-party APIs, and interconnected systems. section 8.1.1
- Prioritize threats by their risk and potential effect before choosing mitigations. section 8.1 section 8.1.2
- Treat security as a design-wide concern rather than a feature added late in development. section 8.0
Applying STRIDE to an IT asset-management system
Use STRIDE to simulate spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege. For spoofing, examine forged device, IP, or DNS identities; possible responses include segmentation, encryption, DNSSEC, multi-factor authentication, role-based access control, and audits. For repudiation, examine whether users can deny asset changes; strengthen accountability with attributable authentication, tamper-proof logs, digital signatures, and role-based access. section 8.1.3
Figure 8.1 The workflow of a brainstorming session with ChatGPT
Follow the brainstorming workflow to move from a broad system scenario to focused threats, risk questions, and mitigation steps. section 8.1.2
