Threat modeling with four questions

Threat modeling means looking at a design and asking how it could be attacked before attackers do. Most modern approaches rest on Shostack's Four Question Framework, which Adam Shostack created at Microsoft and which the Threat Modeling Manifesto also uses: What are we working on? What can go wrong? What are we going to do about it? Did we do a good job?

Take a “reset password” feature. What are we working on? Draw it: customer, web app, database and email service, with a trust boundary between the internet and your system. What can go wrong? STRIDE gives prompts: could someone spoof the customer, tamper with the reset token, or leak reset links? What are we going to do about it? Short-lived single-use tokens, rate limits, and no hint about whether an email exists. Each threat is mitigated, eliminated, transferred or accepted, on purpose.

Did we do a good job? Check that the diagram matches what was built, that every threat has an owner and a decision, and that tests prove the fixes work. Threat modeling is not a one-off document: repeat it whenever the design changes, even as a ten-minute conversation in sprint planning.