Threat Modeling

Threat Modeling: Analyzes potential attackers, attack vectors, and protective measures during the design phase. This topic facilitates the transparent assessment and management of cyber risksCyber RiskThe possibility that a cyber threat will cause harm to systems, data, people, or business objectives.. Decisions should be based on protection requirementsProtection RequirementThe required level of protection derived from the value and sensitivity of an asset or process., likelihoodLikelihoodAn estimate of how likely it is that a defined risk scenario will occur. of occurrence, impactImpactThe consequence a security event or risk scenario would have for an organization or system., controls, and accepted residual riskResidual RiskThe risk remaining after controls and treatment measures have been applied..

How it works and where it fits

Threat Modeling structures knowledge about potential adversaries, their objectives, capabilities, infrastructure, and observed behavior. Individual indicators are short-lived and easy to change, while behavioral patterns and technical relationships often have greater analytical value. Reporting should distinguish observed facts, assessments, and assumptions.

Practical security relevance

Practical use depends on source quality, timeliness, and relevance to the organization’s own attack surface. Information is prioritized, correlated with internal data, and converted into searches, detections, or safeguards. Investigation feedback continuously improves the assessment. Confidentiality and permitted sharing are as important as technical exchange formats.

Related concepts

• Cyber Threat IntelligenceCyber Threat IntelligenceProcessed information regarding threat actors, tactics, indicators, and risks.: Processed information regarding threat actors, tactics, indicators, and risks.
• Threat ActorThreat ActorAn individual, group, or organization that intentionally carries out or supports cyberattacks.: An individual, group, or organization that intentionally carries out or supports cyberattacks.
• MITRE ATT&CKMITRE ATT&CKStructures known tactics and techniques of real-world cyberattacks.: Structures known tactics and techniques of real-world cyberattacks.
• Lockheed Martin Diamond ModelLockheed Martin Diamond ModelAnalysis model linking attackers, capabilities, infrastructure, and victims.: Analysis model linking attackers, capabilities, infrastructure, and victims.