Skip to main content

Threat modelling

Threat modelling from your product architecture

Threat analysis / Industrial gatewayWorked example · v1.0.0
Follow the exposed interfaceIllustrative architecture · select a threat to trace its flow
SITE NETWORK / TRUST BOUNDARYEXTERNAL SERVICES◇Operator browserHTTPS client◇Local controllerField interface◇Management APIConfigurationDBConfiguration storeLocal storage◇Update clientFirmware intake↗Telemetry serviceRemote endpoint↗Update servicePackage deliveryF1F2F3F4F5
F4 · HTTPS
SOURCEupdate-serviceFirmware package
DESTINATIONupdate-clientCheck the trust assumption
T-01 / F4For review

An untrusted update is installed

An attacker replaces a firmware package before the gateway installs it. Transport protection alone does not establish who produced the package.

Condition
The gateway accepts a package without verifying a trusted signature and the intended product identity.
Consequence
Attacker-controlled firmware can change device behaviour and expose credentials.
Proposed measure
Verify the signature and package identity before installation, protect the trust anchor and reject disallowed rollback versions.
Managed industrial network · remote updates and telemetryIllustrative analysis · verification planned

From analysis to verification

Keep the reason behind each security measure

A threat record should explain why a measure is needed and how the team will check it. Select a stage to follow the example you chose above.

T-01

An untrusted update is installed

F4T-01Linked record
Condition
The gateway accepts a package without verifying a trusted signature and the intended product identity.
Consequence
Attacker-controlled firmware can change device behaviour and expose credentials.

Reviewing a model

The product team supplies the judgement

Sytance helps organise the architecture, draft scenarios and connect the records. Engineers still need to check whether the assumptions, consequences and proposed measures fit the product.

Read the threat modelling guide
Review trigger / worked example

The maintenance API becomes remotely accessible

Review who can reach the API and which operations each role can perform. Revisit threats that relied on the service being accessible only from the local network.

Source records
Architecture and interface records
Review scope
Authentication, operation permissions and network exposure
Confirm the changes against the implemented product.

Further reading

Methods, examples and practical questions

Apply STRIDE to a product data flowIndustrial gateway threat analysis exampleThreat analysis for connected medical devicesCRA risk assessment and technical documentation

How does AI help with the analysis?

AI drafts the product model and proposes attack scenarios using the information you provide. Your team checks the assumptions, corrects the model and decides which threats and measures to retain.

Can we use our existing architecture?

Use the existing design to describe components, interfaces and data flows in the model. Confirm permissions, deployment assumptions and security controls with the people responsible for the design.

What does the public example show?

The industrial gateway example traces three attacks through a data-flow diagram, proposed controls and verification methods. You can read the architecture, threat records and proposed verification methods without an account.

Start with your product architecture, software inventory and existing analysis, then develop the security records you need.

Create a product