Threat Modeling: Think Like an Attacker

What Threat Modeling Is

Most people approach security reactively: something bad happens, they buy a tool, they hope the tool prevents the next thing. Threat modeling flips this around. It is a structured way of thinking about security before something goes wrong, by asking four fundamental questions:

1. What am I protecting?
2. Who might want to attack it?
3. How might they do it?
4. How do I prioritize my defenses?

Threat modeling was originally a software engineering discipline, but the core thinking applies equally well to personal security, home networks, small businesses, and critical infrastructure.

Step 1: Identify Your Assets

Start by listing what you are trying to protect. Assets are not just data — they include systems, reputations, relationships, and time.

For an individual, assets might include:

• Email account (gateway to all other accounts)
• Financial accounts and credit
• Identity documents and personal information
• Private communications and photos
• Professional reputation

For a small business:

• Customer data and payment information
• Intellectual property and source code
• Employee records
• Business continuity (the ability to keep operating)
• Brand reputation

Ranking these by importance forces prioritization. You cannot protect everything equally — you should protect the most critical things first.

Step 2: Identify Your Adversaries

Different attackers have different capabilities, motivations, and targets. A realistic threat model names specific adversary types rather than a vague "hackers."

Common adversary profiles:

• Opportunistic criminals — automated bots and low-skill attackers looking for easy targets. They scan for exposed services, try leaked passwords, and send mass phishing emails. They move on quickly if you are not trivially vulnerable.
• Targeted criminals — motivated by financial gain and willing to invest time. Ransomware groups, business email compromise (BEC) gangs, and identity thieves.
• Insider threats — disgruntled employees, contractors with excessive access, or careless staff who make mistakes.
• Nation-states — relevant only for specific high-value targets: government contractors, journalists covering sensitive topics, dissidents, or executives at critical infrastructure companies.
• Stalkers or abusive ex-partners — personally motivated, may have existing knowledge of your habits and accounts.

Most individuals and small businesses face the first two. Accurately assessing who is likely to target you prevents both under-investment (ignoring real threats) and over-investment (building nation-state-grade defenses against opportunistic spam bots).

Step 3: Identify Attack Vectors

How would an adversary realistically reach your assets? Common attack paths include:

• Phishing emails — still the most common initial access method for everything from ransomware to credential theft
• Reused or breached passwords — credentials from old breaches used against current accounts
• Unpatched software — known vulnerabilities exploited before updates are applied
• Social engineering — manipulating people rather than systems (impersonating IT support, fake emergency calls)
• Physical access — unlocked devices, shoulder surfing, or an adversary with physical presence
• Supply chain — compromise through a trusted vendor or software dependency

For each attack vector, ask: is this realistic for my adversaries? Do I have controls that mitigate it?

Step 4: Assess Likelihood and Impact

Not every threat deserves equal attention. Use a simple risk matrix:

• High likelihood + High impact = Address immediately
• High likelihood + Low impact = Address cost-effectively
• Low likelihood + High impact = Maintain awareness, have a plan
• Low likelihood + Low impact = Accept the risk

For most individuals, reused passwords (high likelihood, high impact) should be the first priority. For a healthcare business, unencrypted patient data at rest (regulatory and legal impact) takes priority regardless of breach likelihood.

Step 5: Select Countermeasures

Once you know what you are defending, who is attacking, and how, you can make rational decisions about controls:

• Phishing → Security awareness training, email filtering, MFA
• Breached passwords → Password manager, unique passwords per site, breach monitoring
• Unpatched software → Automatic updates, asset inventory, patch management
• Physical access → Full-disk encryption, screen lock, clean desk policy
• Insider threat → Least privilege, access logging, separation of duties

The STRIDE Framework

For software developers and security engineers, STRIDE is a structured way to categorize threats:

• Spoofing — impersonating another user or system
• Tampering — modifying data in transit or at rest
• Repudiation — denying that an action occurred
• Information disclosure — exposing data to unauthorized parties
• Denial of service — making a system unavailable
• Elevation of privilege — gaining access beyond what is authorized

Apply STRIDE to each component of your system to surface threats you might otherwise miss.

Keeping It Practical

Threat modeling does not require expensive tools or consultants. A whiteboard, a list of assets, and an honest conversation about who might want them is enough to start. Revisit your model when:

• You add new systems or services
• Your business or personal situation changes
• A significant public breach affects software you use
• You hire new employees with elevated access

The goal is not a perfect, comprehensive model. The goal is to spend your limited security resources on the threats most likely to affect you.