Threat Model Examples

This repository contains various threat model examples for different technologies and systems. These resources can help security professionals, developers, and researchers understand the security risks and best practices for mitigating potential threats in a variety of platforms.

---

1. Web & API Security

• OAuth 2.0
  OAuth 2.0 Threat Model (RFC 6819)

• SSL
  

• DNSSEC, DoT, and DoH
  DNSSEC, DoT, and DoH Threat Model

• Web Application
  OWASP Threat Modeling Process

---

2. Cloud & Container Security

• Kubernetes

  • Kubernetes Threat Model - CNCF Financial User Group
  • Kubernetes Hardening Guidance (DoD) (Page 5)
  • Kubernetes Threat Model - CloudSecDocs
  • Kubernetes Threat Modeling - Accuknox
  • A Deep Dive Into Kubernetes Threat Modeling - Trend Micro
  • Kubernetes Threat Modeling - GitHub

• Docker

  • Docker Threat Model - CloudSecDocs
  • Docker Threat Modeling and Top 10 - OWASP Foundation

• AWS Fargate
  AWS Fargate Threat Modeling - Sysdig

---

3. Mobile & IoT Security

• Mobile Applications

  • Securing Mobile Applications Guide - Synopsys
  • Mobile Application Threat Modeling - TeamCISO

• IoT Authentication IoT Authentication Threat Modeling - SAFECode (Page 18)

• IoT Devices
  IoT Devices Security Threat Models - PSA Certified

• Smart Home
  Smart Home Threat Model - GitHub

---

4. Enterprise Security

• PCI DSS
  PCI Threat Model - Adam Shostack

• Password Storage Module (PSM)
  Secure Password Storage - OWASP

• Certificate Transparency
  Certificate Transparency Threat Analysis

• Account Takeover (ATO)
  ATO Threat Model Checklist

• Password Managers
  Password Manager Threat Model - Stanford (Page 5)

---

5. Specialized Systems & Technologies

• AMPS and SNAP Medical Systems
  MITRE Playbook for Threat Modeling Medical Devices (Pages 3 and 49)

• ROS 2 Robotic System

  • ROS 2 Threat Model
  • MARA Threat Model - GitHub

• Web-based User Feedback System
  SAFECode Threat Modeling Whitepaper (Page 16)

• Future E-voting System
  Swiss Post E-voting Vulnerabilities

• Supply Chain
  Supply Chain Threat Modeling Video

---

6. Cloud & Distributed Systems

• Cloud Computing

  • Cloud Computing Risk Assessment - ENISA
  • Cloud Computing Threat Modeling Template - GitHub

• Bitcoin
  Bitcoin Security Threat Model - GitHub

• OpenStack

  • OpenStack Security Threat Analysis
  • OpenStack Threat Modeling Process - GitHub

---

7. Security for Remote & Distributed Work

• Remote Work
  Remote Work Threat Modeling - FireEye

---

8. CI/CD & Firmware Security

• CI/CD Pipeline

  • CI/CD Threat Matrix - GitHub
  • CI/CD Security Risks - GitHub

• Firmware

  • Firmware Threat Modeling Template - GitHub
  • Firmware Threat Model - TrustedFirmware

---

Contributing

Feel free to contribute additional threat model examples or improvements to existing entries. Open a pull request to share your work with the community!

License

This repository is licensed under the MIT License - see the LICENSE file for details.

---