Threat Modeling
Anticipating threats before programming
Threat modeling consists of systematically identifying what can go wrong in an application before writing the first line of code, instead of discovering it later through a real incident. A widely used approach is STRIDE, which evaluates each system component against six threat categories: spoofing, tampering, repudiation, information disclosure, denial of service and elevation of privilege. The result isn't a document that gets filed away, but a concrete list of mitigations built directly into the design: which data to encrypt, which validations to add, which permissions to restrict. Doing it early in the design, and not as a later audit, makes it possible to correct architectural decisions that would be much costlier to change once the system is already in production.