skills.rest
williamzujkowski
williamzujkowskiCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

threat-modeling

Apply STRIDE threat modeling and DREAD prioritization to identify security threats.

17|1|Updated Jun 8, 2025
Search Tags:#architecture#security#cybersecurity#risk-assessment#threat-modeling#stride#sdlc#proactive-security#dread
One-click install
npx skills add https://github.com/williamzujkowski/standards --skill threat-modeling
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: threat-modeling
Source: https://github.com/williamzujkowski/standards/tree/main/skills/security/threat-modeling
Command: npx skills add https://github.com/williamzujkowski/standards --skill threat-modeling

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

This skill provides a structured approach to identify, assess, and mitigate potential security threats in your software systems. It simplifies complex threat modeling methodologies like STRIDE and DREAD, enabling proactive security measures and reducing the attack surface before vulnerabilities are exploited.

Core Features & Use Cases

  • STRIDE Threat Categorization: Guides on identifying Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege threats.
  • Data Flow Diagram (DFD) Analysis: Teaches how to visualize system components and data flows to uncover attack vectors.
  • Mitigation Planning: Provides templates for developing effective strategies to address identified threats.
  • Use Case: Conduct a threat model for a new microservice using the STRIDE methodology, automatically generating a data flow diagram and a list of potential threats with suggested mitigations.

Quick Start

Generate a STRIDE threat modeling template for a user authentication system, listing potential threats and mitigation ideas.

Frequently Asked Questions about threat-modeling

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I identify security threats in my software architecture?▼

Threat modeling is a structured process to identify security threats by analyzing your system's architecture, data flows, and trust boundaries. STRIDE methodology categorizes threats as Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege, helping you systematically uncover vulnerabilities before deployment.

What is STRIDE threat modeling and when should I use it?▼

STRIDE is a threat categorization framework that maps six threat types to system components and data flows. Use it during design phases for web applications, microservices, cloud systems, and mobile platforms to proactively identify attack vectors and prioritize security controls before vulnerabilities are exploited.

How do I create a data flow diagram for threat analysis?▼

Data flow diagrams (DFDs) visualize system components, data movement, and trust boundaries to reveal attack surfaces. Map processes, data stores, external entities, and data flows, then apply STRIDE to each element to identify threats at process entry points, storage, and inter-component communication.

How do I prioritize security threats using DREAD scoring?▼

DREAD prioritization scores threats across Damage, Reproducibility, Exploitability, Affected Users, and Discoverability. This quantitative approach ranks identified threats by severity, enabling you to allocate mitigation resources to the highest-risk vulnerabilities first and align with NIST security controls.

Can I use threat modeling for microservices and cloud architectures?▼

Yes. Threat modeling applies across microservices, cloud platforms, and web applications. The methodology scales by decomposing distributed systems into services and data flows, then mapping STRIDE threats and trust boundaries at each service boundary and cloud resource layer.

What should I include in a threat mitigation plan?▼

A mitigation plan addresses identified threats with specific countermeasures, assigns ownership, sets deadlines, and tracks implementation. Templates guide you to map each threat to NIST controls, define detection and prevention strategies, and document residual risk acceptance decisions.

Related Skills

Explore More Legal & Compliance Skills→
jassicsjassics
6

threat-model-dfd

Generate Data Flow Diagrams with trust boundaries for STRIDE/PASTA threat modeling.

Community
Intermediate
voidrotvoidrot

threat-mitigation-mapping

Map threats to security controls and prioritize remediation efforts.

Community
Advanced
jieni777jieni777
1

security-auditor

Automate security audits and compliance assessments across DevSecOps pipelines.

Community
Advanced
MonumentalSystemsMonumentalSystems
17

threat-modeling

Structure threat discovery and risk prioritization using STRIDE, PASTA, and LINDDUN frameworks.

Official
Intermediate