The method
The approach starts with a data flow diagram (DFD): processes, data stores, flows, external entities, and trust boundaries where the privilege level changes. This diagram is the basis for finding threats, rather than starting from an abstract attack list.
The STRIDE grid (Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege), from Microsoft, helps systematically scan possible threats on each diagram element. Other grids exist for specific needs, such as LINDDUN for privacy.
For more complex threats, an attack tree details the steps an attacker must take to reach their goal, with AND/OR gates like a fault tree. Threat modeling links naturally to the MITRE ATT&CK knowledge base, which catalogues observed attack techniques.
When to use it
- Designing an application, API or architecture, before or during development.
- Security review of an existing system, to spot blind spots.
- As input to EBIOS RM workshops 3 and 4, to detail operational scenarios.
Watch out for
- A diagram that is too detailed or too coarse makes the exercise ineffective: aim for component level, not code.
- Threat modeling covers a system or application; it does not replace an organisational risk analysis such as EBIOS RM.
- Redo it after every significant architecture change, not just once.
Steps
- Draw the data flow diagram: components, flows, data stores, external entities.
- Place trust boundaries, wherever privilege or trust level changes.
- For each element crossing a boundary, apply the STRIDE grid and list plausible threats.
- Prioritise threats by impact and ease of exploitation.
- Define mitigations and verify they are actually implemented.
Threat modeling tools
List from the Aurorisk catalogue, links checked on 2026-09-26. Confirmed free access is listed first; unknown information is labelled.
| Tool | Source · licence · access | Scope | Description |
|---|---|---|---|
| MITRE ATT&CK Navigator ↗ | Association or foundationOpen sourceFree | United States | Map attack techniques. |
| OWASP Threat Dragon ↗ | Association or foundationOpen sourceFree | International | Threat modelling (STRIDE, LINDDUN…), desktop or web. |
Standards and references
- STRIDE (Microsoft)
- MITRE ATT&CK
- LINDDUN (vie privée)