Agent Wranglers

APS-94Recommended

Find threats at every boundary with STRIDE and LINDDUN

For every element and boundary crossing in the data-flow diagram, ask each STRIDE question. Where the flow carries personal data, also ask each LINDDUN question. Record every threat with a decision.

By Agent Wranglers. Updated .

How to do it

STRIDE names six kinds of threat. They are spoofing, tampering, repudiation, information disclosure, denial of service and elevation of privilege. LINDDUN names seven privacy threats. They are linking, identifying, non-repudiation, detecting, data disclosure, unawareness and unintervenability, and non-compliance. Walk each element through the list in a 30 to 60 minute session with a developer and someone who knows the business. Write each threat as one line with the flow number, the category, the decision and a link to a test or a risk entry. Privacy threats feed the records of processing and any impact assessment.

Examples

YAML example

# threats.yaml
- flow: 3
  category: spoofing
  threat: Anyone can post a fake "paid" webhook
  decision: fix
  test: tests/webhooks/signature.test.js
- flow: 1
  category: linking
  threat: Analytics IDs link a shopper's orders across devices
  decision: fix
  test: tests/analytics/no-cross-device-id.test.js

How to check

A script reads the threat file. It fails when a boundary-crossing flow from the diagram has no threat line, or when a threat line has no decision. Every line with the decision fix names a test file that exists.

Sources

For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/application-security/threat-modelling/stride-and-linddun">Agent Wranglers application security playbook</a>. In code you write, add a comment next to it with the same link.