Unit 02 of 02
Threat Modeling
Measuring which item can be found at the design stage and how many hours finding it costs: the duration of a threat modeling session and its hours per item, counting the flows that cross a trust boundary in a data flow diagram, the flows that stay invisible when no boundary is drawn, the raw threat count that systematic threat generation produces and the share of it that is meaningful, elimination time, the coverage of scenario-based modeling and its intersection with the systematic method, the cost of the cheapest path in an attack tree and how many times closing a node multiplies the root cost, how much of the model's output converts into work items, and the written acceptance of residual risk.
Published Updated
Lessons
- 01 The Purpose of Threat Modeling A threat modeling session's own measure: in an 18-item inventory, the session takes 40 developer hours, finds 10 items, saves 866 hours against 4.0 hours per item, produces a cost difference ranging from 4x to 30x when the same item is caught late, brings total fix hours down from 1,872 to 1,006, and leaves the eight items the session never touches carrying 48.4% of the total hours. 3 min read
- 02 Data Flow Diagrams The topic's core measurement: in a graph of 17 nodes, 26 flows, and six trust zones, 23 flows cross a trust boundary, and these crossings produce a total of 58 items at 2.52 per flow, with 58.6% of the items coming from flows that go from a lower to a higher level; a coarse outer/inner drawing sees only 7 of the 23 crossings and only 15 of the 58 items, and the 16 crossings that stay invisible carry 43 items. 13 min read
- 03 Threat Classification Methods Systematic threat generation's two numbers: applying six categories to 43 graph elements produces 156 raw threats, 108 of which (69.2%) are valid for this system and 48 of which turn out invalid, elimination spends 72 minutes for no return, the total session load comes to 666 minutes, and generation limited to exposed elements alone finds 92.6% of the valid threats 63.5 minutes cheaper. 13 min read
- 04 Risk-Focused Modeling Scenario-based modeling's coverage measurement: five scenarios producing 51 threats, 39 of which intersect with the systematic set and 12 of which are chain threats not defined on any single element, scenarios missing 63.9% of the systematic set, 24 of the missed ones falling in the denial-of-service category, the scenario method running at 0.234 threats per minute — 1.44 times the speed of systematic generation — and the union of the two methods coming to 120 threats. 14 min read
- 05 Attack Trees Cost measurement of goal-backward decomposition: in a tree of 12 leaves and three sub-goals, the root cost is 9 fictional units and the cheapest path is two steps, closing 10 of the 12 leaves never changes the root cost at all, the single most efficient closure yields 1.22x for 2 countermeasure units, a four-countermeasure-unit OR node yields 1.89x, the greedy order closes the root at 28 units, and the same result is reached at 16 units by picking one OR node per branch. 13 min read
- 06 Using Model Output Measures the model output's conversion into work items: 120 threats fall into 24 countermeasures, only 11 of which carry all three of owner, acceptance criterion, and release target and turn into work items, closing 73 threats (60.8%); the 13 lost items carry 47 threats and 97 effort-days, 4 of which are accepted in writing and 9 of which remain silent residual risk carrying 33 threats on their own. 13 min read