Explain like I'm five · Security

What is Threat Modeling?

Threat modeling, told as a story about a guard who puts on a thief's mask and studies the drawing before a single brick is laid.

NEW STOREHOUSE TOWERfront doorvaultdelivery hatchgreat! start building tomorrowwait. one more lookthe builder brought the drawing for a new tower

The builder brought the drawing for a new tower.One front door, one vault, one delivery hatch. The king wants to build right away. The guard asks for one more look.

guarding the front doorslipping in through the hatchbut that is a hatch, not a door…realizing after it is built that the hatch was a door too — that is too late

Realizing after it is built that the hatch was a door too — that is too late.The guard watched the front door. The thief came through the hatch. Fixing it now means tearing the wall down again.

THE DRAWING — THROUGH A THIEF'S EYESthe trusted insidefront doorvaultdelivery hatch12● where a thief could get inthe guard tries on a thief's maskwhat are we building? where would a thief go? what can go wrong? how do we stop it?before a single brick, rob the tower on paper first

Threat modeling is looking at the drawing through a thief's eyes before building.The guard tries on the thief's mask. Draw what is being built, find where a thief would enter, ask what could go wrong, and write the fix onto the drawing.

What are we building?draw the rooms and the paths
Where would a thief go?mark every way in
What can go wrong?six habits, one by one
How do we stop it?draw the fix in first
ask about each of the six thief habits, one by onedisguisewalks in as the buildertamperingchanges the numbers in the bookdenialit was not mepeekingpeeks inside the vaultblockingblocks the door with a cartmore keysstoreroom key opens the vaultsix questions at every door — what if a thief tried this habit right here?

Ask about each of the six thief habits, one by one.Six questions at every door. "What if a thief disguised himself here? Tampered? Denied it? Peeked? Blocked it? Got more keys?" So no habit is forgotten.

THE FIXED DRAWINGfront doorvaultdelivery hatcha gatekeeper and a log at the hatch tooa separate vault keynow we buildfixed on paper it costs a brick — fixed after building, a whole tower

The fixes go onto the drawing before building.A gatekeeper and a log at the hatch, a separate key for the vault. Then check every brick, and once built, a hired thief tests it for real.

In one breath

Threat modeling = before laying a brick, look at the drawing through a thief's eyes, find the ways in and what could go wrong, and draw the fixes in first.

Threat Modeling. Diagram the system's assets and data flows, mark trust boundaries and entry points, enumerate threats with a framework like STRIDE, and fold mitigations into the design. It is the cheapest point to build security in.

When grown-ups say it

Threat modeling
The drawing through a thief's eyes. Rob the tower on paper before building it. Four questions: what are we building, where would a thief go, what can go wrong, how do we stop it.
Data flow diagram
The rooms-and-paths picture. The vault, the hatch, and the arrows between them. Without this picture you do not even know what to guard.
Trust boundary
The dashed line around the trusted inside. Inside the line are our people; outside are strangers. Every arrow that crosses the line gets a question.
Entry point
Where a thief could get in. Not just the front door — the hatch, the windows, the chimney. → counting our doors from outside
STRIDE
The six thief habits. Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege. The first letters spell STRIDE.
Attack tree
The thief's plan, drawn as a tree. Under 'open the vault' hang branches: steal the key, use the hatch… Block the easiest branch first.
Mitigation
The fix drawn into the plan. The gatekeeper at the hatch, the separate vault key, the log. → the castle that asks at every door
DevSecOps
Where this drawing gets looked at. The way the guard sits beside the builder from the start. Reading the drawing is the first job. → the builder and the guard, side by side
Next story
Never Nail the Key to the Wall →
Want another term as a picture book? Request →