# Threat Modeling Case Studies 1. ### **Web Application Case Study** #### **System Overview** A web application that allows users to: * Register and authenticate * Upload and share files * Send messages to other users * View and update their profile #### **Data Flow Diagram** ```mermaid flowchart LR     User((User))     WebServer[Web Server]     AppServer[Application Server]     Database[(Database)]     FileStorage[(File Storage)]         User -->|HTTP/HTTPS| WebServer     WebServer -->|Internal API| AppServer     AppServer -->|SQL Queries| Database     AppServer -->|Store/Retrieve Files| FileStorage         %% Trust Boundaries     subgraph Internet         User     end         subgraph DMZ         WebServer     end         subgraph Internal Network         AppServer         Database         FileStorage     end         style Internet fill:#f9f9f9,stroke:#666,stroke-width:2px,color:#333     style DMZ fill:#ffffde,stroke:#666,stroke-width:2px,color:#333     style Internal Network fill:#e6f3ff,stroke:#666,stroke-width:2px,color:#333 ``` #### **STRIDE Analysis**

Component

Threat

Mitigation

Authentication

Spoofing (Brute force attacks)

Rate limiting, account lockout, MFA

File Upload

Tampering (Malicious file uploads)

File type validation, malware scanning

User Actions

Repudiation (Denying performed actions)

Secure logging of all security-relevant events

User Data

Information Disclosure (Data leakage)

Data encryption, access controls

Web Server

Denial of Service (Traffic flood)

Rate limiting, CDN, scaling capabilities

Access Control

Elevation of Privilege (IDOR)

Proper authorization checks, RBAC

2. ### **IoT Device Case Study** #### **System Overview** A smart home IoT device that: * Connects to a home WiFi network * Communicates with a cloud service * Is controlled via a mobile app * Controls physical devices (e.g., lights, locks) #### **Attack Tree** ```mermaid graph TD     A[Compromise IoT Device] --> B[Attack Hardware]     A --> C[Attack Software]     A --> D[Attack Communications] A --> E[Attack Cloud Services]         B --> B1[Physical Tampering]     B --> B2[Side-channel Attacks]     B --> B3[Debug Port Access]         C --> C1[Firmware Exploitation]     C --> C2[Memory Corruption]     C --> C3[Authentication Bypass]         D --> D1[Network Sniffing]     D --> D2[Man-in-the-Middle]     D --> D3[Replay Attacks]     E --> E1[API Vulnerabilities] E --> E2[Account Takeover] E --> E3[Insufficient Access Control]         style A fill:#f96,stroke:#333,stroke-width:2px ``` #### **DREAD Assessment for "Authentication Bypass"**

Category

Rating (1-10)

Reasoning

Damage

9

Complete control of the device

Reproducibility

7

Once discovered, can be consistently exploited

Exploitability

5

Requires moderate technical knowledge

Affected Users

10

All users of the device

Discoverability

6

Requires targeted testing to discover

Overall Risk

7.4

Medium-High Risk

3. ### **Microservices Application Case Study** #### **System Overview** A microservices architecture with: * Multiple service containers * API Gateway * Service-to-service communication * Shared data stores * Authentication services #### **Data Flow Diagram** ```mermaid flowchart TD     Client((Client))     Gateway[API Gateway]     Auth[Auth Service]     Users[User Service]     Orders[Order Service]     Products[Product Service]     UserDB[(User Database)]     OrderDB[(Order Database)]     ProductDB[(Product Database)]         Client -->|HTTPS| Gateway     Gateway -->|Validate Token| Auth     Gateway -->|User Operations| Users     Gateway -->|Order Operations| Orders     Gateway -->|Product Operations| Products         Users -->|Read/Write| UserDB     Orders -->|Read/Write| OrderDB     Products -->|Read/Write| ProductDB         Orders -->|Get User Info| Users     Orders -->|Get Product Info| Products         subgraph ServiceMesh[Service Mesh]         Auth         Users         Orders         Products     end         style ServiceMesh fill:#e6f3ff,stroke:#666,stroke-width:2px,color:#333 ``` #### **Key Threats and Mitigations**

Threat

Affected Component

Mitigation

Unauthorized service-to-service calls

Service Mesh

Mutual TLS, service identity

API Gateway bypass

API Gateway

Network segmentation, ingress control

Insecure direct object references

All Services

Proper authorization on all endpoints

Data leakage between tenants

All Databases

Data partitioning, row-level security

Token theft

Auth Service

Short token lifetimes, token validation

4. ### **Financial Institution - Online Banking Platform** #### **System Overview** A major financial institution's online banking platform that provides: * Account access and management * Fund transfers * Bill payments * Mobile check deposits * Financial reporting #### **Data Flow Diagram** ```mermaid flowchart TD     Customer((Customer))     WAF[Web Application Firewall]     LoadBalancer[Load Balancer]     WebApp[Web/Mobile Front-end]     APIGateway[API Gateway]     AuthService[Authentication Service]     FraudDetection[Fraud Detection]     TransactionService[Transaction Service]     AccountService[Account Service]     NotificationService[Notification Service]     CoreBankingSystem[(Core Banking System)]     DataWarehouse[(Data Warehouse)]         Customer -->|HTTPS| WAF     WAF -->|Filtered Traffic| LoadBalancer     LoadBalancer -->|Balanced Traffic| WebApp     WebApp -->|API Requests| APIGateway         APIGateway -->|Auth Requests| AuthService     APIGateway -->|Transaction Requests| TransactionService     APIGateway -->|Account Requests| AccountService         AuthService --> FraudDetection     TransactionService --> FraudDetection         TransactionService -->|Process Transactions| CoreBankingSystem     AccountService -->|Account Information| CoreBankingSystem         TransactionService -->|Transaction Events| NotificationService     NotificationService -->|SMS/Email| Customer         CoreBankingSystem --> DataWarehouse         subgraph DMZ         WAF         LoadBalancer     end         subgraph Application Layer         WebApp         APIGateway         AuthService         FraudDetection         TransactionService         AccountService         NotificationService     end         subgraph Data Layer         CoreBankingSystem         DataWarehouse     end         style DMZ fill:#ffffde,stroke:#666,stroke-width:2px,color:#333     style Application Layer fill:#e6f3ff,stroke:#666,stroke-width:2px,color:#333     style Data Layer fill:#ffe6e6,stroke:#666,stroke-width:2px,color:#333 ``` #### **STRIDE Analysis**

Component

Threat

Impact

Mitigation

Authentication

Spoofing (Credential theft)

Unauthorized account access

MFA, anomaly detection, secure session management

Transaction Processing

Tampering (Transaction manipulation)

Financial fraud

Digital signatures, transaction verification steps

Audit Trail

Repudiation (Denying financial transactions)

Dispute resolution challenges

Immutable logging, digital receipts

Customer Data

Information Disclosure (Data breach)

PII/financial data exposure

Encryption, data minimization, access controls

Banking Services

Denial of Service (System unavailability)

Service interruption

Redundancy, rate limiting, DDoS protection

Access Controls

Elevation of Privilege (Admin rights)

Unauthorized system access

Strict RBAC, JIT access, privilege monitoring

5. ### **Healthcare System - Electronic Health Records** #### **System Overview** A hospital system's electronic health records (EHR) platform with: * Patient records management * Prescription handling * Lab test ordering and results * Medical imaging integration * Billing and insurance processing #### **Data Flow Diagram** ```mermaid flowchart TD     MedStaff((Medical Staff))     Patient((Patient))     Admin((Admin Staff))         AuthN[Authentication System]     EHRPortal[EHR Portal]     PatientPortal[Patient Portal]     AdminPortal[Admin Portal]         FHIR[FHIR API Gateway]         PatientRecords[Patient Records Service]     Medications[Medications Service]     Imaging[Imaging Service]     Billing[Billing Service]     Audit[Audit Service]         PatientDB[(Patient Database)]     MedicationDB[(Medication Database)]     ImagingStore[(Imaging Store)]     BillingDB[(Billing Database)]     AuditLogs[(Audit Logs)]         MedStaff -->|Login| AuthN     Patient -->|Login| AuthN     Admin -->|Login| AuthN         AuthN -->|Access Grant| EHRPortal     AuthN -->|Access Grant| PatientPortal     AuthN -->|Access Grant| AdminPortal         EHRPortal -->|API Calls| FHIR     PatientPortal -->|Limited API Calls| FHIR     AdminPortal -->|Admin API Calls| FHIR         FHIR -->|Patient Data| PatientRecords     FHIR -->|Medication Data| Medications     FHIR -->|Image Requests| Imaging     FHIR -->|Billing Info| Billing         PatientRecords -->|Read/Write| PatientDB     Medications -->|Read/Write| MedicationDB     Imaging -->|Store/Retrieve| ImagingStore     Billing -->|Process| BillingDB         FHIR -.->|Log All Access| Audit     Audit -->|Write Logs| AuditLogs         subgraph Hospital Network         EHRPortal         AuthN         FHIR         PatientRecords         Medications         Imaging         Billing         Audit     end         subgraph Data Stores         PatientDB         MedicationDB         ImagingStore         BillingDB         AuditLogs     end         style Hospital Network fill:#e6ffe6,stroke:#666,stroke-width:2px,color:#333     style Data Stores fill:#e6e6ff,stroke:#666,stroke-width:2px,color:#333 ``` #### **Key Threats and Mitigations**

Threat

Impact

Mitigation

Unauthorized access to patient records

Patient privacy violation, HIPAA breach

Fine-grained access controls, need-to-know basis

Medication prescription tampering

Patient safety risk

Digital signatures, verification workflow

EHR data breach

Mass disclosure of protected health information

Encryption, data segmentation, access monitoring

Ransomware attack

System unavailability, data loss

Robust backups, security patching, network segmentation

Insider threat

Targeted data access, privacy violations

Least privilege access, behavior analytics, audit logging

Medical device compromise

Patient safety, data integrity issues

Device security policies, network isolation, monitoring

6. ### **E-commerce Platform** #### **System Overview** A large e-commerce platform that supports: * Product browsing and searching * User accounts and profiles * Shopping cart and checkout * Payment processing * Order fulfillment and shipping #### **Data Flow Diagram** ```mermaid flowchart TD     Customer((Customer))     CDN[CDN]     WebApp[Web Application]     MobileApp[Mobile Application]         APIGateway[API Gateway]     AuthService[Auth Service]     ProductService[Product Service]     CartService[Cart Service]     OrderService[Order Service]     PaymentService[Payment Service]         ProductDB[(Product Database)]     UserDB[(User Database)]     CartDB[(Cart Database)]     OrderDB[(Order Database)]         PaymentProcessor([3rd Party Payment Processor])     ShippingProvider([3rd Party Shipping])         Customer -->|Browse| CDN     Customer -->|HTTPS| WebApp     Customer -->|HTTPS| MobileApp         WebApp -->|API Calls| APIGateway     MobileApp -->|API Calls| APIGateway         APIGateway -->|Auth Requests| AuthService     APIGateway -->|Product Requests| ProductService     APIGateway -->|Cart Operations| CartService     APIGateway -->|Order Operations| OrderService     APIGateway -->|Payment Processing| PaymentService         AuthService -->|User Data| UserDB     ProductService -->|Catalog Data| ProductDB     CartService -->|Cart Data| CartDB     OrderService -->|Order Data| OrderDB         PaymentService -->|Process Payment| PaymentProcessor     OrderService -->|Shipping Request| ShippingProvider         subgraph Frontend         CDN         WebApp         MobileApp     end         subgraph Microservices         APIGateway         AuthService         ProductService         CartService         OrderService         PaymentService     end         subgraph Databases         ProductDB         UserDB         CartDB         OrderDB     end         subgraph External Services         PaymentProcessor         ShippingProvider     end         style Frontend fill:#f9f9f9,stroke:#666,stroke-width:2px,color:#333     style Microservices fill:#e6f3ff,stroke:#666,stroke-width:2px,color:#333     style Databases fill:#e6ffe6,stroke:#666,stroke-width:2px,color:#333     style External Services fill:#fff2e6,stroke:#666,stroke-width:2px,color:#333 ``` #### **STRIDE Analysis**

Component

Threat

Impact

Mitigation

User Authentication

Account takeover

Unauthorized purchases, data access

Strong authentication, account lockouts, fraud detection

Payment Processing

Credit card theft

Financial loss, reputation damage

PCI-DSS compliance, tokenization, encryption

Product Listings

Price manipulation

Revenue loss

Digital signatures, price verification

Shopping Cart

Cart manipulation

Price/item tampering

Server-side validation, integrity checks

Checkout Flow

Session hijacking

Order interception

TLS, secure cookies, session management

User Reviews

Content injection

Platform abuse, reputational damage

Input validation, content moderation

7. ### **Cloud Infrastructure Provider** #### **System Overview** A cloud infrastructure provider offering: * Virtual machine instances * Managed databases * Storage solutions * Networking services * Identity and access management #### **Data Flow Diagram** ```mermaid flowchart TD     Customer((Customer))     DevOps((DevOps Team))     LoadBalancer[Load Balancer]     APIGateway[API Gateway]         WebConsole[Web Console]     CLI[Command-Line Tools]     SDKs[Developer SDKs]         IAM[Identity & Access Management]     ComputeService[Compute Service]     StorageService[Storage Service]     DatabaseService[Database Service]     NetworkingService[Networking Service]         MetadataService[Instance Metadata Service]     OrchestrationEngine[Orchestration Engine]     BillingSystem[Billing System]         HypervisorHosts[Hypervisor Hosts]     PhysicalStorage[Physical Storage Arrays]     NetworkFabric[Network Fabric]         Customer -->|Console Access| LoadBalancer     DevOps -->|Admin Access| LoadBalancer         LoadBalancer -->|Route Traffic| WebConsole     LoadBalancer -->|Route Traffic| APIGateway         WebConsole -->|API Calls| APIGateway     CLI -->|API Calls| APIGateway     SDKs -->|API Calls| APIGateway         APIGateway -->|Authenticate| IAM     APIGateway -->|Compute Requests| ComputeService     APIGateway -->|Storage Requests| StorageService     APIGateway -->|DB Requests| DatabaseService     APIGateway -->|Network Requests| NetworkingService         ComputeService -->|Create/Manage VMs| HypervisorHosts     ComputeService -->|Instance Metadata| MetadataService     StorageService -->|Allocate/Manage| PhysicalStorage     NetworkingService -->|Configure| NetworkFabric         IAM -.->|Auth Decisions| ComputeService     IAM -.->|Auth Decisions| StorageService     IAM -.->|Auth Decisions| DatabaseService     IAM -.->|Auth Decisions| NetworkingService         ComputeService -->|Deploy Resources| OrchestrationEngine     StorageService -->|Deploy Resources| OrchestrationEngine     DatabaseService -->|Deploy Resources| OrchestrationEngine     NetworkingService -->|Deploy Resources| OrchestrationEngine         OrchestrationEngine -->|Resource Usage| BillingSystem         subgraph Control Plane         APIGateway         IAM         ComputeService         StorageService         DatabaseService         NetworkingService         MetadataService         OrchestrationEngine         BillingSystem     end         subgraph Data Plane         HypervisorHosts         PhysicalStorage         NetworkFabric     end         style Control Plane fill:#e6f3ff,stroke:#666,stroke-width:2px,color:#333     style Data Plane fill:#ffe6e6,stroke:#666,stroke-width:2px,color:#333 ``` #### **Key Threats and Mitigations**

Threat

Impact

Mitigation

Multi-tenant escape

Customer data breach, cross-account access

Strong isolation, hypervisor hardening, regular patching

API abuse

Service disruption, unauthorized access

Rate limiting, API authentication, activity monitoring

IAM misconfiguration

Excessive permissions, data exposure

Least privilege access, permission boundaries, policy validation

SSRF against metadata service

VM takeover, credential theft

Instance metadata service controls, network segmentation

Supply chain compromise

Backdoor insertion, persistent access

Vendor assessment, code signing, CI/CD security

Physical security breach

Hardware tampering, data theft

Datacenter security, disk encryption, secure decommissioning

8. ### **Mobile Payment Application** #### **System Overview** A mobile payment application that provides: * Peer-to-peer money transfers * QR code and contactless payments * Bill splitting functionality * Transaction history * Bank account and card linking #### **Data Flow Diagram** ```mermaid flowchart TD     User((User))     Merchant((Merchant))         MobileApp[Mobile Application]     MerchantPOS[Merchant POS]         APIGateway[API Gateway]     AuthService[Authentication Service]     UserService[User Service]     PaymentService[Payment Service]     NotificationService[Notification Service]     FraudService[Fraud Detection]         UserDB[(User Database)]     TransactionDB[(Transaction DB)]     TokenVault[(Token Vault)]         BankNetwork([Banking Network])     CardNetwork([Card Network])         User -->|Open App| MobileApp     Merchant -->|Payment Request| MerchantPOS         MobileApp -->|Authenticate| APIGateway     MobileApp -->|Transfer Money| APIGateway     MobileApp -->|Pay Merchant| APIGateway     MerchantPOS -->|Process Payment| APIGateway         APIGateway -->|Verify User| AuthService     APIGateway -->|User Operations| UserService     APIGateway -->|Process Payment| PaymentService         AuthService -->|Validate| UserDB     UserService -->|Account Info| UserDB     PaymentService -->|Record Transaction| TransactionDB     PaymentService -->|Check Fraud| FraudService         PaymentService -->|Use Payment Token| TokenVault     TokenVault -->|Process ACH| BankNetwork     TokenVault -->|Process Card| CardNetwork         PaymentService -->|Transaction Confirmation| NotificationService     NotificationService -->|Push Notification| MobileApp         subgraph MobilePOS[Mobile & POS]         MobileApp         MerchantPOS     end         subgraph AppServices[Application Services]         APIGateway         AuthService         UserService         PaymentService         NotificationService         FraudService     end         subgraph DataStorage[Data Storage]         UserDB         TransactionDB         TokenVault     end         subgraph ExternalNetworks[External Networks]         BankNetwork         CardNetwork     end         style MobilePOS fill:#f9f9f9,stroke:#666,stroke-width:2px,color:#333     style AppServices fill:#e6f3ff,stroke:#666,stroke-width:2px,color:#333     style DataStorage fill:#e6ffe6,stroke:#666,stroke-width:2px,color:#333     style ExternalNetworks fill:#fff2e6,stroke:#666,stroke-width:2px,color:#333 ``` #### **DREAD Analysis for "Account Takeover"**

Category

Rating (1-10)

Reasoning

Damage

10

Complete financial loss, identity theft

Reproducibility

6

Requires specific user targeting

Exploitability

5

Requires bypassing multiple security controls

Affected Users

8

Individual accounts, but can be done at scale

Discoverability

7

Public mobile app with observable security controls

Overall Risk

7.2

High Risk

9. ### **Automotive Connected Vehicle System** #### **System Overview** A modern connected vehicle platform that includes: * In-vehicle infotainment system * Remote vehicle control (lock/unlock, climate) * Telematics and vehicle health monitoring * Over-the-air software updates * Emergency services communication #### **Data Flow Diagram** ```mermaid flowchart TD     Driver((Driver))     MobileApp[Mobile App]     InVehicleSystem[In-Vehicle System]         CloudBackend[Cloud Backend]     IdentityService[Identity Service]     VehicleCommandService[Vehicle Command Service]     TelematicsService[Telematics Service]     UpdateService[Update Service]         VehicleCAN[Vehicle CAN Bus]     BodyControlModule[Body Control Module]     EngineCU[Engine Control Unit]     InfotainmentSystem[Infotainment System]     Telematics[Telematics Control Unit]         VehicleDB[(Vehicle Database)]     UserDB[(User Database)]     TelematicsDB[(Telematics DB)]     SoftwareRepo[(Software Repository)]         EmergencyServices([Emergency Services])     DealershipSystems([Dealership Systems])         Driver -->|Mobile Control| MobileApp     Driver -->|Direct Interaction| InVehicleSystem         MobileApp -->|HTTPS| CloudBackend     InVehicleSystem -->|4G/5G| CloudBackend         CloudBackend -->|Auth Requests| IdentityService     CloudBackend -->|Vehicle Commands| VehicleCommandService     CloudBackend -->|Telemetry Data| TelematicsService     CloudBackend -->|Software Updates| UpdateService         IdentityService -->|User Data| UserDB     VehicleCommandService -->|Vehicle Status| VehicleDB     TelematicsService -->|Store Telemetry| TelematicsDB     UpdateService -->|Fetch Updates| SoftwareRepo         VehicleCommandService -->|Send Commands| Telematics     TelematicsService -->|Receive Data| Telematics     UpdateService -->|Send Updates| Telematics         Telematics -->|Vehicle Network| VehicleCAN     InfotainmentSystem -->|Media/Navigation| VehicleCAN         VehicleCAN -->|Control Signals| BodyControlModule     VehicleCAN -->|Engine Management| EngineCU         Telematics -.->|Emergency Call| EmergencyServices     TelematicsService -.->|Diagnostics| DealershipSystems         subgraph MobileCloud[Mobile & Cloud]         MobileApp         CloudBackend         IdentityService         VehicleCommandService         TelematicsService         UpdateService     end         subgraph VehicleSystems[Vehicle Systems]         InVehicleSystem         Telematics         VehicleCAN         BodyControlModule         EngineCU         InfotainmentSystem     end         subgraph CloudStorage[Cloud Storage]         VehicleDB         UserDB         TelematicsDB         SoftwareRepo     end         style MobileCloud fill:#e6f3ff,stroke:#666,stroke-width:2px,color:#333     style VehicleSystems fill:#ffe6cc,stroke:#666,stroke-width:2px,color:#333     style CloudStorage fill:#e6ffe6,stroke:#666,stroke-width:2px,color:#333 ``` #### **Key Threats and Mitigations**

Threat

Impact

Mitigation

Remote vehicle control exploit

Safety risk, unauthorized control

Command authentication, secure boot, message authentication

CAN bus injection

Vehicle safety systems compromise

Gateway filtering, bus segmentation, intrusion detection

Infotainment system compromise

Entry point to critical systems

Domain separation, privilege boundary, sandboxing

Telematics unit exploitation

Location tracking, privacy breach

Data minimization, encryption, secure communication

Software update tampering

Malicious code execution

Code signing, update verification, secure delivery

Mobile app API abuse

Unauthorized vehicle access

Strong API security, rate limiting, anomaly detection