How do you model threats to a complex information system?

Threat Modeling can be done at any stage of the system development but to maximize the benefits of the exercise it is best done at the design phase.

I share @Matt Coles' perspective on STRIDE as a methodology. I've observed that some people use STRIDE to refer to the Microsoft Threat Modeling Tool, which is based on the STRIDE approach itself. In my experience, developers sometimes struggle with the STRIDE terms. So, I opt for a simpler rule: assessing potential security, privacy, and safety issues in the design, while also considering the preservation of system and data confidentiality, integrity, and availability. In the past, DREAD was commonly used alongside STRIDE to determine the severity of identified threats - the reason it is thought of as a framework for TM. However, I've noticed a shift towards the adoption of CVSS calculator, leading to DREAD being gradually replaced.

To clarify, STRIDE is one approach or methodology for performing threat modeling rather than being a tool itself; there are a number of tools that implement the STRIDE methodology for threat analysis. DREAD is a method for assessing the severity of threats identified by STRIDE, although it has been declared "dead" by some; OWASP Risk Rating Methodology, CVSS, and CWSS are other methods for severity determination of threats. In addition to tools like the Microsoft Threat Modeling Tool or OWASP Threat Dragon in which users can draw diagrams and identify threats, there exists a class of tools for creating models and performing analysis by writing code to describe a system; OWASP pytm is an example of this class of tool.

One of the major benefits of Threat Modeling is that when it is done right like in mature organizations, it can drive the entire Secure Development Lifecycle and not just be limited as a secure design verification activity.

There are at least 3 solid Threat Modeling reference books available to consider: "Threat Modeling: Designing for Security" being the gold standard, "Threat Modeling: A Practical Guide for Development Teams" which looks across the threat modeling landscape for developers to consider, and "Threat Modeling" (the original reference from Microsoft). Additionally there are great books on securing systems, applying secure design principles, and creating secure architectures that can help new or experienced security practitioners to learn critical security concepts or patterns that will help them be better at threat modeling. Lastly, threat modeling is not just for security; be sure to check out resources for Privacy-focused Threat Modeling.

1. We need to talk about sequence diagrams for critical transactions. 2. FAQs like when is a Threat Model really complete etc. 3. Mention other frameworks like PASTA, LINDDUN etc. Doesn't hurt to mention commercial tools either :)