Threat Modeling Vocabulary | Security Lab Exercises

1 / 5

An architect says: "We need to identify the trust boundaries in this data flow diagram before we continue the STRIDE analysis."

What is a trust boundary in threat modeling?

Trust boundary = a line in a Data Flow Diagram (DFD) where data moves between different trust levels, requiring validation or re-authentication.

Trust boundary crossing example	Threat question to ask
Internet → Web application (DMZ)	Who can impersonate a legitimate user? (Spoofing)
Web application → Internal API (intranet)	Can input data be tampered with in transit? (Tampering)
Application → Database	Is authorisation re-checked at this layer? (Elevation of Privilege)
User browser → CDN → Origin	Can a CDN node disclose sensitive data? (Information Disclosure)

Key vocabulary:

Trust boundary crossing — data moving from a lower-trust to a higher-trust zone (or vice versa)
Validation required — all input crossing a trust boundary must be validated before being processed
Privilege transition — a change in the security context (e.g., anonymous → authenticated)
DFD (Data Flow Diagram) — the diagramming notation used in structured threat modeling to map processes, data stores, external entities, and data flows

2 / 5

A security team is applying the STRIDE threat modeling framework. What does the "T" in STRIDE stand for, and what threat does it model?

STRIDE is a Microsoft-developed threat modeling framework. Each letter maps to a threat category and a violated security property.

Letter	Threat	Security property violated	Example
S	Spoofing	Authentication	Forging a JWT to impersonate another user
T	Tampering	Integrity	Modifying an order amount in transit (MITM)
R	Repudiation	Non-repudiation	Denying that an action was performed (insufficient audit logs)
I	Information Disclosure	Confidentiality	Leaking PII in error messages or logs
D	Denial of Service	Availability	Flooding an API endpoint to make it unavailable
E	Elevation of Privilege	Authorisation	Exploiting a bug to gain admin rights from a regular user account

3 / 5

In a threat modeling session, a security engineer says: "The attack surface is too large — we need to reduce it before we can build a meaningful threat model."

What does "attack surface" mean?

Attack surface = the total set of different points where an attacker could try to enter a system or extract data from it.

Attack surface component	Example	Reduction technique
Network-exposed endpoints	Public API, admin panel, SSH port open to internet	Close unnecessary ports; use VPN for admin access
Input entry points	Web forms, file uploads, querystring parameters	Validate and sanitise all input; disable unused endpoints
Third-party dependencies	npm packages, open-source libraries	Minimise dependency count; audit supply chain
Internal services	Microservices communicating without mutual TLS	Zero-trust internal networking; mTLS between services

Key principle: "Attack surface reduction" = remove, disable, or restrict anything not strictly necessary. Every unused feature, open port, or exposed interface is a potential entry point.

4 / 5

The threat model identifies a Spoofing threat for the user authentication flow. Which control typically mitigates spoofing threats?

Spoofing = impersonating another user or system. The primary mitigation is strong authentication — making identity unforgeable.

STRIDE threat	Primary mitigation
Spoofing	Strong authentication (MFA, signed tokens, certificates), session binding
Tampering	HMAC / message signatures, TLS, access controls on data stores
Repudiation	Tamper-evident audit logging, digital signatures on critical actions
Information Disclosure	Encryption at rest and in transit, role-based access control
Denial of Service	Rate limiting, auto-scaling, DDoS mitigation (CDN, WAF)
Elevation of Privilege	Principle of least privilege, input validation, authorisation checks

Why the other options are incomplete: Rate limiting slows brute force but doesn't prevent spoofing with a stolen credential. Input validation prevents injection. Network segmentation limits reach but doesn't authenticate identity.

5 / 5

A threat model report recommends risk responses of "accept, mitigate, transfer, or avoid." The engineering team concludes: "The risk is low and the cost of mitigation is too high — we will accept it."

Which risk response strategy is this?

Risk acceptance = the team has evaluated the risk and consciously decided not to act on it. This is a valid and documented strategy — not inaction through ignorance.

Risk response	Action taken	Example
Accept	Acknowledge and consciously decide not to act; document in risk register	Low-severity theoretical attack vector with no known exploit
Mitigate	Implement controls to reduce likelihood or impact	Add WAF, MFA, input validation to reduce risk to acceptable level
Transfer	Shift risk to a third party (insurance, vendor SLA, contractual liability)	Cyber insurance policy covering breach costs
Avoid	Eliminate the risky activity entirely	Remove the feature that introduces the risk from the product

Risk acceptance requires documentation and sign-off — it must be a deliberate decision by a risk owner, not an oversight. Key vocabulary: "residual risk", "risk appetite", "risk register", "risk owner", "accepted with conditions".