Tutorial 3: Threat Modeling and Attack Trees

Unit 1 ยท Security foundations and risk

Objectives

Threat modeling is a structured design activity, not a one-time compliance form. Start with assets and data-flow diagrams. Mark processes, stores, external entities, and boundaries. Ask how an attacker could spoof identity, tamper with data, repudiate action, expose information, deny service, or gain unauthorized privilege.

Goal: access protected report
OR: steal session token
    AND: cause XSS + reach victim
OR: abuse authorization
    AND: obtain account + exploit IDOR

Attack trees show alternative paths with OR nodes and combined prerequisites with AND nodes. Controls should interrupt high-value paths. Include assumptions, attacker capabilities, dependencies, and abuse cases; otherwise the model quietly describes only the happy path.

Exercises

  1. Draw a data-flow diagram for a file-upload service.
  2. Apply STRIDE questions to its upload endpoint and storage.
  3. Create an attack tree for reading another user's file.

Self-check

  1. What does a trust boundary mark?
  2. What does an OR node mean?
  3. Why model abuse cases?

Self-Check Quiz

1. What should be marked before threats?

AnswerAssets, data flows, components, external entities, and trust boundaries.

2. What does tampering threaten?

AnswerIntegrity.

3. Where should a control be placed?

AnswerAt a point that interrupts a realistic attack path, ideally with independent layered defenses for high-impact assets.

Homework

  1. Threat-model an administrative reporting system.
  2. Produce an attack tree for unauthorized report modification.
  3. Map controls to attack-tree branches and identify uncovered paths.
Sample answer

A complete model marks the browser, API, identity provider, report service, database, and administrator as separate entities or processes. The modification goal may be reached through credential theft, authorization bypass, or compromised service identity. Controls include MFA, server-side authorization, parameterized updates, audit logs, and review alerts, with residual risk documented.