Debrief

Aliases

Threat Modeling

Citation Status
Verified
Cited in Generated Atlas
Design Consequence

At a release or runtime crossing, map the plausible leak and abuse paths that can change the design. Scale the depth to the receiver and consequence.

Full Citation

Shostack, A. (2014). Threat Modeling: Designing for Security. Indianapolis: Wiley. ISBN 978-1-118-80999-0.

Generated Atlas Citations
Source Class
Practitioner
Themes
Leakage & Threat
The Snag

Leak and abuse paths go unnoticed until exploited.

The Move

Map the plausible leak and abuse paths at the actual audience or runtime crossing, then focus on the paths that can change the design.

The Cure

Use a proportionate threat-model pass at the release or runtime boundary and carry forward the design-changing findings.

The Read

A concrete receiver and consequence reveal which leak and abuse paths materially shape the surface.