LearnViz CompSci
Home / Learn / Security & Cryptography / Threat Modeling

Advanced Topic 46 of 51 Security & Cryptography

Threat Modeling

Systematically identifying and prioritizing threats.

How it works

Threat modeling is a structured way to identify what could go wrong with a system and decide what to do about it, ideally during design. Steps include describing the system with data flow diagrams, identifying assets and trust boundaries, enumerating threats with methods such as STRIDE, spoofing, tampering, repudiation, information disclosure, denial of service and elevation of privilege, rating risk and choosing mitigations. Attack trees and the PASTA process are alternatives.

Step-by-step walkthrough

  1. Draw data flows and trust boundaries.
  2. Apply STRIDE: spoofing, tampering, repudiation, information disclosure, denial of service, elevation.
  3. Rank by likelihood and impact.
  4. Plan fixes before building.
  5. Update the model as the system changes.

Where it is used

Teams threat model new features, architectures and integrations to build security requirements and tests early, when changes are cheap.

Common pitfall

A model that is done once and filed away quickly goes stale; update it when the design changes. Focusing only on technical threats and ignoring abuse cases or insiders leaves gaps. Overly detailed exercises burn time. Involve developers and operations, keep it lightweight and track mitigations as work items.

Where it fits in the course

Threat Modeling is topic 46 of 51 in Security & Cryptography, rated Advanced. It follows Digital Forensics. The next topic is Zero Trust Architecture.

Practice and explore

How to study this topic

  1. Read the explanation above and restate the definition in your own words.
  2. Open the interactive lesson and answer its mini quiz.
  3. Read the common pitfall, then write a short example that avoids it.
  4. Check your understanding in the Security & Cryptography quiz, and revisit the topic if you miss a question.

Frequently asked questions

What is Threat Modeling?
Systematically identifying and prioritizing threats. It belongs to Security & Cryptography and is an advanced-level topic.
Where do people use Threat Modeling?
Teams threat model new features, architectures and integrations to build security requirements and tests early, when changes are cheap.
What is the most common mistake with Threat Modeling?
A model that is done once and filed away quickly goes stale; update it when the design changes.
What should I learn before this topic?
Start with Digital Forensics, the topic just before it in Security & Cryptography.
How can I practice it?
Answer the mini quiz in the interactive lesson, then take the Security & Cryptography quiz.
Is Threat Modeling hard to learn?
It is an Advanced topic. Expect to read the explanation more than once and to connect it with earlier topics. Working through a small example by hand helps most.
How long does it take to learn Threat Modeling?
Most learners can read the explanation and finish the interactive lesson in under an hour. Fluency comes from applying the idea, so plan a few short practice sessions with the quiz.
Which topics are related to Threat Modeling?
Digital Forensics, Zero Trust Architecture, Reverse Engineering are closely connected. The full list is in the related topics section of this page.
What should I study after Threat Modeling?
Continue with Zero Trust Architecture, the next topic in Security & Cryptography.

Related topics