DATA FLOWS · STRIDE · OWNERS

Threat Modeling Template

A compact STRIDE and data-flow worksheet for turning architecture discussions into prioritized threats, controls, and follow-up tests.

A useful threat model produces decisions: what matters, how it can fail, which controls own the risk, and how those controls will be checked.

PHASE 01

Draw the data flow

Include users, services, stores, third parties, admin tools, and trust boundaries. Label sensitive data and privileged operations.

  • Keep the diagram small enough to discuss.
  • Mark where identity, input, and secrets cross boundaries.
Secure Code Review Checklist →

PHASE 02

Apply STRIDE to each boundary

Ask about spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege.

  • Write abuse cases in attacker language.
  • Prioritize by impact, exposure, and existing control strength.
Authentication and Authorization Testing →

PHASE 03

Assign and validate controls

Turn threats into a control, owner, due date, and validation test. Accepted risk should have a reason and review date.

  • Link decisions to design or backlog work.
  • Retest when the architecture changes.
OWASP WSTG Testing Methodology →

Frequently asked questions

When should threat modeling happen?

At design time and again when a meaningful trust boundary, data flow, dependency, or privileged capability changes.