Managing Threats

Managing Threats

Learn how to identify, document, and manage threats in TMI.

Overview

Threat management is the core of threat modeling. TMI helps you systematically identify, assess, and track threats to your system.

Threat Frameworks

STRIDE

Microsoft's STRIDE framework categorizes threats:

• Spoofing: Impersonating users or systems
• Tampering: Unauthorized modification of data
• Repudiation: Denying actions without proof
• Information Disclosure: Exposing sensitive information
• Denial of Service: Making systems unavailable
• Elevation of Privilege: Gaining unauthorized access

CIA Triad

Focus on:

• Confidentiality: Unauthorized access to data
• Integrity: Unauthorized modification
• Availability: System or data unavailability

Custom Frameworks

Create your own threat categories based on:

• Industry-specific threats
• Organizational risk framework
• Compliance requirements

Creating Threats

Adding a New Threat

1. Navigate to threats section
2. Click "New Threat" or "Add Threat"
3. Fill in threat details
4. Link to affected components
5. Save

Threat Properties

Required Fields

• Title: Short, descriptive name
• Description: Detailed explanation
• Category: Framework category (STRIDE, CIA, etc.)

Optional Fields

• Impact: Consequences if exploited (High/Medium/Low)
• Likelihood: Probability of occurrence (High/Medium/Low)
• Risk Level: Overall risk (High/Medium/Low or calculated)
• Status: New, Investigating, Mitigated, Accepted, Not Applicable
• Affected Components: Link to diagram elements
• Mitigation: How to address the threat
• Notes: Additional context
• Metadata: Custom properties

Threat Identification Techniques

Component-Based Analysis

For each component in your diagram:

• What threats apply to this component type?
• What data does it handle?
• What trust boundaries does it cross?

Data Flow Analysis

For each data flow:

• Can data be intercepted?
• Can data be modified?
• Is data properly validated?
• Is data properly encrypted?

STRIDE per Element

Apply STRIDE to each diagram element:

Process threats:

• Spoofing process identity
• Tampering with process
• Repudiation of process actions
• Information disclosure from process
• Denial of service to process
• Elevation of privilege in process

Data Store threats:

• Tampering with stored data
• Information disclosure from store
• Denial of service to store

Data Flow threats:

• Tampering with data in transit
• Information disclosure of data
• Denial of service to flow

External Entity threats:

• Spoofing external entity
• Repudiation of external entity actions

Trust Boundary Analysis

At each trust boundary:

• What authentication occurs?
• What authorization is required?
• What data validation happens?
• What logging exists?

Risk Assessment

Assessing Impact

High Impact:

• Complete system compromise
• Loss of critical data
• Regulatory violations
• Significant financial loss
• Life/safety impact

Medium Impact:

• Partial system compromise
• Loss of non-critical data
• Moderate financial loss
• Reputation damage

Low Impact:

• Minor inconvenience
• Minimal data exposure
• Low financial loss

Assessing Likelihood

High Likelihood:

• Easy to exploit
• Common attack vector
• Public exploits available
• High attacker motivation

Medium Likelihood:

• Moderate skill required
• Some protective measures exist
• Moderate attacker motivation

Low Likelihood:

• Difficult to exploit
• Strong protections in place
• Low attacker motivation

Threat Severity Values

TMI uses the following severity values for threats:

Severity	Description
Critical	Exploitable vulnerability enables complete system compromise, data breach, or safety impact; requires immediate action.
High	Significant impact or high likelihood; enables major unauthorized access, privilege escalation, or service disruption.
Medium	Moderate impact or likelihood; limited data exposure, partial functionality impairment, or requires chained exploits.
Low	Minimal impact or low likelihood; negligible business impact, requires specific conditions or user interaction.
Informational	No direct exploitability; recommendation, best practice deviation, or configuration improvement.
Unknown	Threat severity has not yet been assessed.

Threat Priority Values

TMI uses the following priority values for threats:

Priority	Description
Immediate (P0)	Must be addressed urgently; active exploitation, regulatory violation, or critical business exposure.
High (P1)	Requires prompt resolution; high-risk exposure or upcoming release deadline.
Medium (P2)	Address within standard development cycles; moderate exposure.
Low (P3)	Include in backlog for future cycles; no immediate exposure.
Deferred (P4)	Postponed with documented business approval; tracked but not scheduled.

Risk Level Calculation

Common approaches:

Qualitative:

• High Impact + High Likelihood = High Risk
• High Impact + Low Likelihood = Medium Risk
• Low Impact + Any Likelihood = Low Risk

Quantitative:

• Risk Score = Impact × Likelihood
• Use numeric scales (1-5, 1-10)

Mitigation Strategies

Types of Mitigation

Eliminate: Remove the vulnerability entirely

• Redesign the system
• Remove risky features
• Change architecture

Reduce: Lower the risk level

• Add security controls
• Implement defenses
• Add monitoring

Transfer: Shift the risk

• Use third-party services
• Insurance
• Contractual agreements

Accept: Consciously accept the risk

• Document decision
• Approve at appropriate level
• Monitor over time

Documenting Mitigations

For each threat, document:

• Control Description: What will be implemented
• Control Type: Preventive, Detective, Corrective
• Implementation Status: Planned, In Progress, Complete
• Owner: Who is responsible
• Timeline: When will it be done
• Verification: How to verify it works

Example Mitigations

Threat: SQL Injection in user search

Mitigations:

1. Use parameterized queries (Eliminate)
2. Input validation and sanitization (Reduce)
3. Web application firewall (Reduce)
4. Database activity monitoring (Detect)
5. Least privilege database accounts (Reduce)

Linking Threats to Components

Why Link?

• Visual representation on diagrams
• Track which components are affected
• Prioritize component security
• Impact analysis for changes

Creating Links

1. Edit threat
2. Find "Affected Components" or "Linked Components"
3. Select diagram(s) and component(s)
4. Save

Using Links

• See threats when viewing diagrams
• Filter threats by component
• Impact analysis when modifying components

Threat Lifecycle

Threat Status Values

TMI uses the following status values for individual threats:

Status	Description
Open	The finding has been identified and documented but no action has been initiated.
Confirmed	The threat has been validated as legitimate through analysis or evidence.
Mitigation Planned	A remediation or mitigation strategy has been defined and assigned.
Mitigation In Progress	Implementation of controls, code changes, or countermeasures is underway.
Verification Pending	Mitigation is complete; security team must test or review effectiveness.
Resolved	The threat is fully mitigated and verified; residual risk is acceptable.
Accepted	The threat is acknowledged but intentionally not mitigated (e.g., due to business justification); requires formal risk acceptance.
False Positive	Investigation determined the finding is not a valid threat; no further action required.
Deferred	Action is postponed with approval (e.g., for future sprints); includes rationale and due date.
Closed	The finding is archived after resolution, acceptance, or invalidation, with audit trail.

Tracking Progress

• Update status as work progresses
• Link to issue tracker tickets
• Document decisions in notes
• Review regularly

Integration with Issue Tracking

Creating Tickets

1. Select threat
2. Click "Create Issue" or "Link Issue"
3. Choose issue tracker
4. Populate issue details
5. Track in both systems

Syncing Status

• Issue status can sync to TMI
• Track remediation progress
• Close threats when issues resolve

See Issue Tracker Integration for details.

Threat Reports and Views

Filtering Threats

Filter by:

• Category: Show only specific STRIDE/CIA categories
• Risk Level: High, Medium, Low
• Status: New, Mitigated, etc.
• Component: Threats affecting specific components
• Metadata: Custom filters

Sorting Threats

Sort by:

• Risk level (High to Low)
• Status
• Creation date
• Last modified
• Title (alphabetically)

Threat Statistics

View summary:

• Total threats
• Threats by category
• Threats by risk level
• Threats by status
• Coverage metrics

Collaboration on Threats

Team Review

• Share threat model with team
• Review threats together
• Use real-time editing
• Discuss mitigations

Assignment

• Assign threats to team members
• Track ownership
• Review responsibility

Discussion

• Comment on threats
• @mention team members
• Document decisions
• Track conversations

Best Practices

Be Specific

• Clear, descriptive threat titles
• Detailed descriptions
• Concrete examples
• Specific mitigations

Focus on Actionable Threats

• Prioritize realistic threats
• Don't get lost in theoretical threats
• Focus on what can be mitigated

Document Decisions

• Why risks were accepted
• Why mitigations were chosen
• Assumptions made
• Tradeoffs considered

Regular Review

• Review as system changes
• Re-assess as threat landscape evolves
• Update mitigations
• Close resolved threats

Link Everything

• Link to diagrams
• Link to issue tracker
• Link to documentation
• Link to security controls

Examples

Example 1: Authentication Threat

Title: Brute Force Attack on Login

Category: Elevation of Privilege (STRIDE)

Description: Attacker attempts to guess user passwords through automated login attempts.

Impact: High - Account compromise, data breach

Likelihood: High - Common attack, easily automated

Risk Level: High

Mitigation:

• Rate limiting (5 attempts per 15 minutes)
• Account lockout after 10 failed attempts
• CAPTCHA after 3 failed attempts
• Multi-factor authentication
• Password complexity requirements
• Monitor for brute force patterns

Status: Mitigated

Example 2: Data Exposure Threat

Title: Sensitive Data in Application Logs

Category: Information Disclosure (STRIDE)

Description: Application logs may contain PII or credentials if exceptions are logged verbosely.

Impact: Medium - Data breach, compliance violation

Likelihood: Medium - Common developer mistake

Risk Level: Medium

Mitigation:

• Log sanitization framework
• Code review for logging statements
• Log access controls
• Automated log scanning
• Developer training

Status: In Progress

Next Steps

• Learn about Collaborative Threat Modeling
• Explore Issue Tracker Integration
• Review Security Best Practices

Related Topics

• Working with Data Flow Diagrams
• Creating Your First Threat Model
• Using Notes and Documentation