后端应用的威胁建模

Threat modeling applies security principles early: you map what could go wrong before you build, so defenses are designed in rather than bolted on.

Threat modeling answers four questions: What are we building? What can go wrong? What will we do about it? Did we do a good job?

Start by listing your assets — credentials, payment data, personal records, API keys. They define what you are protecting and where to focus.

Every place data enters is part of your attack surface: endpoints, file uploads, message queues, config. Catalog them — you cannot defend what you have not listed.

A trust boundary is where data crosses from less-trusted to more-trusted territory, like the public internet meeting your service. Validate everything that crosses it.

STRIDE categorizes threats: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, and Elevation of privilege.

Apply STRIDE per entry point. For a login: can it be spoofed with stolen tokens, tampered, or hit with credential stuffing? Each yes is a threat to mitigate.

Sketch a data flow diagram: client to API to database, with trust boundaries as dashed lines. It makes threats visible and is the model's working artifact.

You cannot fix everything at once. Rank threats by likelihood times impact so easy, high-damage threats get handled before theoretical edge cases.

Map each threat to a mitigation: spoofing to strong auth, tampering to integrity checks, disclosure to encryption. These controls feed your design and backlog.

A threat model is not a one-time doc. Revisit it whenever you add an endpoint, integrate a service, or change a boundary — keep it matched to reality.

Test your threat modeling knowledge.

You learned to threat model before coding: identify assets and entry points, mark trust boundaries, enumerate threats with STRIDE, then prioritize and map to controls.