Why threat modeling fails, and how to make it not
Threat modeling has a reputation as a time sink that produces nothing, and that reputation is earned by how it is usually done. Three ways it fails:
| Failure mode | How it shows |
|---|---|
| Scope too large | "A threat model for the whole system" — four hours, a 30-page document, unread |
| Output is a document, not work | A list of threats, no tickets, nobody accountable |
| Done too late | After the code exists, so every finding is a refactor rather than a decision |
Making it not fail means inverting all three: one feature, forty minutes, tickets as output.
STRIDE is a prompt list of six threat categories. Its value is not completeness but that it forces you to think along six axes rather than one — and the axis you skip is the one that has never yet caused you an incident.
| Letter | Threat | The concrete question | Control |
|---|---|---|---|
| Spoofing | Impersonation | "Who can claim to be somebody else here?" | Authentication |
| Tampering | Modification | "What can be altered in transit?" | Integrity, signing, parameterisation |
| Repudiation | Denial of action | "If they say they did not, can I prove it?" | Audit logs |
| Information disclosure | Leakage | "What comes out that should not?" | Authorisation, encryption, error messages |
| Denial of service | Availability | "What is the most expensive thing one request can do?" | Bounds, rate limits, timeouts |
| Elevation of privilege | Escalation | "Who can do more than they should?" | Authorisation |
The two most-skipped letters are R and D, each for a different reason:
R (Repudiation) gets skipped because it is not an attack — it is a dispute. The question "if a customer says they did not delete that data, can I prove otherwise?" does not sound like a security question, but it is the one an audit log exists to answer. This is the letter that leads to the security_event table from detect-and-alert.
D (DoS) gets skipped because it feels like an infrastructure problem. But the application-layer question is very concrete and very useful: "what is the most expensive thing one request can do?" An unpaginated export endpoint, a query with no LIMIT, a regex with catastrophic backtracking — all three are application-layer DoS that no load balancer stops.
Comments
Commenting needs an account with at least one completed lesson. That condition is what keeps this thread worth reading: every point belongs to someone who can be asked back, and reputation accrues over time.
You can still read every comment below without an account. Signing in brings you back to this exact spot, not to the top of the page.
Loading comments…