Skip to main content

Threat modelling as you go

A 30-minute habit, not a workshop. At Design, each feature gets a lightweight STRIDE pass — driven by an agent skill, confirmed by humans — producing a threat table stored alongside the PFD (toolkit/templates/pfd.md).

The routine​

  1. Sketch the feature's data flow — trust boundaries, entry points, data stores (the agent drafts this from the design).
  2. STRIDE per element — for each, ask: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege. The skill proposes threats; humans confirm and prune.
  3. SME abuse cases — the domain expert adds insurance-specific ones: fraud vectors, claims manipulation, broker data exposure, sanctions evasion.
  4. Record — a threat table (threat → likelihood/impact → mitigation → owner) stored with the PFD; mitigations become acceptance criteria or backlog items.

Rules​

  • Agents draft, humans confirm. The skill accelerates the boring part (enumerating candidate threats); judgement on what's real stays human.
  • It's a habit. Every feature at Design, every time — 30 minutes. Skipping it isn't a time saving; it's deferred incident cost.
  • Feeds the gates. Unmitigated high threats block the Design Review; mitigations are verified by the security gates.

Standards referenced​

STRIDE, OWASP Threat Modeling. For product features that themselves use LLMs, extend with the OWASP LLM Top 10 (prompt injection, output validation, tool-permission scoping) — LLM application security standard (to follow).