Untrusted request source
DevOps & Tooling / Knowledge library
Threat Modeling
Identifies assets, trust boundaries, adversaries, abuse cases, and mitigations
Why learn Threat Modeling?
It moves security reasoning into system design
The problem it solves
It prioritizes credible risks before vulnerabilities become incidents
Where it came from
Threat Modeling is a security concept that identifies assets, trust boundaries, adversaries, abuse cases, and mitigations. Its guarantees and tradeoffs depend on the concrete implementation and operating context.
Build your understanding
Work through these exercises in order. Try the task before opening a reference.
- Define Threat Modeling and distinguish it from a neighboring concept.
- Choose a realistic task where Threat Modeling is appropriate.
- Identify a failure mode caused by misusing Threat Modeling.
- Interpret a small design or result involving Threat Modeling.
- Explain one tradeoff or limitation of Threat Modeling.
Documentation and sources
- OWASP Developer Guide: Security Principles (devguide.owasp.org)
Connect the ideas
Explore next
Real World Example
Threat Modeling for Financial Ledger Microservices
FinTech organizations managing multi-tenant ledger systems.
The business problem
Unintended lateral movement between tenant data partitions due to poorly defined trust boundaries in microservice communication.
How this topic solves it
Implementing a structured threat modeling process to map assets, identify trust boundaries, and define abuse cases, ensuring that every service-to-service request is explicitly mediated.
- Decompose the system architecture into distinct components and identify sensitive data assets.
- Define trust boundaries between microservices and external ingress points to isolate tenant data.
- Perform an adversary analysis to document potential abuse cases, such as unauthorized cross-tenant data access.
- Design and implement specific mitigations, such as mutual TLS and granular authorization checks, for each identified threat.
- Validate the effectiveness of mitigations against the documented abuse cases.
This diagram illustrates how requests are mediated across defined trust boundaries.
Trust Boundary 1
Internal processing
Asset storage
- External User → HTTPS Request → API Gateway
- API Gateway → Authenticated mTLS → Ledger Service
- Ledger Service → Scoped Query → Database
Expected business outcome
A hardened architecture where trust boundaries are explicitly enforced, significantly reducing the risk of unauthorized cross-tenant data exposure.
Limitations and checks
Threat modeling is a point-in-time exercise; architectural drift can invalidate assumptions, requiring periodic reviews to ensure security controls remain aligned with the current system state.