Threat Modeling¶
Shostack, A. (2014). Threat Modeling: Designing for Security. Wiley.
Cited by¶
7 citations across 7 artifacts.
Each citation links to the sentence it supports in the citing article.
Primes¶
- Authentication
- Authentication enables a family of structural reasoning moves. Threat-model reasoning: for any procedure, the questions are which impostors it stops and which it lets through, which forces enumeration of attack classes — replay, phishing, forgery, side-channel — and a defence matrix against them.
This sourceDevelops systematic threat-model reasoning via STRIDE — enumerating attacker classes (spoofing, replay, tampering) a procedure must stop — central to authentication design.
- Authentication enables a family of structural reasoning moves. Threat-model reasoning: for any procedure, the questions are which impostors it stops and which it lets through, which forces enumeration of attack classes — replay, phishing, forgery, side-channel — and a defence matrix against them.
- Center Of Gravity
- Cybersecurity and resilience engineering: the single service — identity provider, certificate authority, key resolver — whose compromise cascades into systemic failure; threat modelling asks for the COG and defensive design duplicates or compartmentalises it.
This sourceStandard reference on STRIDE and attack trees and the crown-jewel/critical-asset framing — what single compromise (an identity provider or certificate authority) ends the game — with duplicate/distribute/harden/compartmentalize defenses.
- Cybersecurity and resilience engineering: the single service — identity provider, certificate authority, key resolver — whose compromise cascades into systemic failure; threat modelling asks for the COG and defensive design duplicates or compartmentalises it.
- Persona
- Pedagogy. Learner personas — the novice with no background, the second-career learner with rusty prerequisites, the heritage speaker with high oral comprehension but low literacy — surface scaffolds that an "average learner" assumption hides. Public-service design. Citizen personas (the rural elderly user, the recent immigrant, the shift worker) surface access friction that a median-citizen assumption conceals. Security engineering. Threat-actor personas — the script-kid, the financially motivated criminal, the nation-state actor, the malicious insider — let defenders reason concretely about attacker capability, motivation, and likely attack paths.
This sourceDevelops threat-actor archetypes (script-kiddie, organized criminal, nation-state, malicious insider) by motivation and capability to drive defensive design.
- Pedagogy. Learner personas — the novice with no background, the second-career learner with rusty prerequisites, the heritage speaker with high oral comprehension but low literacy — surface scaffolds that an "average learner" assumption hides. Public-service design. Citizen personas (the rural elderly user, the recent immigrant, the shift worker) surface access friction that a median-citizen assumption conceals. Security engineering. Threat-actor personas — the script-kid, the financially motivated criminal, the nation-state actor, the malicious insider — let defenders reason concretely about attacker capability, motivation, and likely attack paths.
- Red Teaming In Strategy
- The penetration-testing insight that an adversary willing to spend X will find vulnerabilities normal-use testing for 100X will not ports to AI capability evaluations, where red-team probing finds elicitation paths benchmark suites miss, and the vocabulary of kill chains and attack surfaces ports with it.
This sourceCodifies kill-chain and attack-surface analysis, the adversarial vocabulary that ports from penetration testing into other capability evaluations.
- The penetration-testing insight that an adversary willing to spend X will find vulnerabilities normal-use testing for 100X will not ports to AI capability evaluations, where red-team probing finds elicitation paths benchmark suites miss, and the vocabulary of kill chains and attack surfaces ports with it.
Domain-specific¶
Mechanisms¶
- Independent Security Review Lenses
- The threat-model lens, walking a STRIDE decomposition, flags an internal endpoint that trusts its caller without authenticating it.
This sourceShostack's STRIDE method walks decomposed system components for threats and treats missing authentication as a spoofing exposure.
- The threat-model lens, walking a STRIDE decomposition, flags an internal endpoint that trusts its caller without authenticating it.
Verification¶
Does it exist? Confirmed. This work's ISBN resolves to a registered record, which fixes its identity. That is all it fixes.
Does it back the claim? Not recorded. Neither this nor any other of the 7 citations of this work carries a recorded support check.
Support is checked per citation rather than per work — the same source can be cited soundly in one article and wrongly in another. Per-citation recording began recently, so a citation with no recorded check is a gap in the record rather than evidence it went unchecked.
See how references were verified.
Links previously used in the corpus¶
Before the registry existed this work was also linked 3 other ways.
- https://www.wiley.com/en-us/Threat+Modeling%3A+Designing+for+Security-p-9781118809990 ×2
- https://www.wiley.com/en-us/Threat+Modeling:+Designing+for+Security-p-9781118809990 ×1
- https://www.worldcat.org/oclc/855043351 ×1
Registry ID ref:060927ebddea · see in the full table