Identifying Threats and Attack Surfaces

With the data flow diagram and trust boundaries already defined, threat identification consists of systematically going through each component, each data flow and each point where the system interacts with an external actor, asking in a structured way what could go wrong at that specific point, instead of depending on someone spontaneously remembering the relevant risks. Applying a framework such as STRIDE at this stage provides exactly that structure, reviewing each diagram element against each threat category (spoofing, tampering, repudiation, information disclosure, denial of service and elevation of privilege), which significantly reduces the likelihood of overlooking an entire category of risk simply because it wasn't the first to come to the team's mind. The attack surface, in this context, is the complete set of points where an external actor can try to interact with the system, and it's usually broader than the team initially assumes, including not only the obvious public interfaces but also internal integrations, automated processes with their own credentials and recovery or administration mechanisms that are rarely used but remain active and accessible. A typical and valuable outcome of this stage is discovering that certain components considered internal and low risk are actually reachable from outside the assumed trust boundary.