Question 1

What is threat modeling and which frameworks are commonly used?

Accepted Answer

Threat modeling is a structured approach to identifying and prioritizing potential security threats to a system. Popular frameworks include STRIDE (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege), DREAD for risk scoring, PASTA for attack simulation, and the LINDDUN framework for privacy threats.

Question 2

When should threat modeling be performed in the development lifecycle?

Accepted Answer

Threat modeling is most effective when started early in the design phase, before code is written. However, it should be revisited whenever significant architectural changes occur, new features are added, or after a security incident. Integrating threat modeling into CI/CD pipelines ensures continuous assessment as the application evolves.

Threat Model

How to play

Frequently Asked Questions