Before you can model threats, you need precise language. This module builds your threat modeling vocabulary — the terms every security conversation depends on.
🎯 Learning Objectives
Define and distinguish: asset, threat, vulnerability, risk, and control
Explain the CIA Triad and why it anchors security thinking
Identify attack surfaces and trust boundaries in a system
Describe the attacker mindset and common attacker goals
Use risk as a function of likelihood × impact
1The Core Vocabulary
These five terms form the skeleton of every security conversation. Confuse them and communication breaks down. Get them right and everything else becomes clearer.
Security Vocabulary Relationship Map
How the five core security terms relate to each other
Term
Definition
Example (Banking App)
Asset
Something valuable that needs protection — data, functionality, or reputation
A potential event that could harm an asset — intentional or accidental
An attacker stealing login credentials via phishing
Vulnerability
A weakness in the system that a threat can exploit
Password reset that only asks for username (no MFA)
Risk
The likelihood a threat will exploit a vulnerability × the impact if it does
High: phishing is common, account takeover impact is severe
Control
A countermeasure that reduces risk (prevents, detects, or limits impact)
MFA, anomalous login detection, rate limiting
2The CIA Triad
Every security property that matters maps to one of three goals. This triangle has guided security thinking for decades — and it still holds up perfectly for threat modeling.
The CIA Triad
The CIA Triad — every security threat attacks one or more of these three properties
Property
Violated By
Threat Example
Control Example
Confidentiality
Unauthorized disclosure
SQL injection exposing user passwords
Encryption, access controls, least privilege
Integrity
Unauthorized modification
Man-in-the-middle changing transaction amounts
Digital signatures, checksums, input validation
Availability
Denial of service
DDoS flood crashing the login service
Rate limiting, CDN, auto-scaling, backups
💡
Beyond CIA: The "AAA" Extensions
Some frameworks extend CIA with: Authentication (proving who you are), Authorization (what you're allowed to do), and Accountability/Non-repudiation (can't deny your actions). STRIDE's categories map to all of these — which you'll see in Module 3.
3Attack Surface
The attack surface of a system is the sum of all points where an attacker can try to enter, extract data, or cause harm. The smaller the attack surface, the fewer places an attacker can probe.
Attack Surface of a Typical Web Application
Every entry point into your system — user inputs, APIs, file uploads, admin panels — is part of the attack surface
Reducing the Attack Surface
Minimize exposure — don't expose APIs or admin panels publicly if they don't need to be
Remove unused features — disabled functionality can't be exploited
Apply least privilege — services only get the permissions they actually need
Segment networks — separate tiers so a breach in one doesn't reach all others
4Trust Boundaries
A trust boundary is a line where data or control flow crosses from one trust level to another. Every time you cross a trust boundary, you must validate, authenticate, and authorize. Missing this is where most vulnerabilities live.
⚠️
The Golden Rule of Trust Boundaries
Never trust data that crosses a boundary without validating it. User input, API responses from external services, data read from the filesystem — all of it crosses a trust boundary and must be treated as potentially hostile.
Trust Boundary Example — 3-Tier Web App
Each dashed boundary is where validation and authentication must happen. Skip a boundary check and you've created a vulnerability.
5The Attacker Mindset
Threat modeling requires you to temporarily switch from a builder mindset to an attacker mindset. Builders ask: "Does this feature work?" Attackers ask: "How can I make this feature do something it wasn't supposed to?"
💰
Financial Gain
Steal money, credit cards, payment info. Ransomware. Most attacks are financially motivated.
🕵️
Data Theft
PII, trade secrets, credentials. Sell on dark markets or use for targeted phishing.
🔌
Disruption
Competitors, hacktivists, nation-states. Take down services to cause reputation or operational damage.
🎭
Privilege Escalation
Gain access to higher-value systems by pivoting from a compromised lower-value one.
🎓
Classroom Exercise: "Evil User Stories"
Have students write evil user stories — the attacker version of a user story. Example: instead of "As a user, I want to reset my password," write "As an attacker, I want to take over any account without knowing its password." This simple reframe unlocks threat identification faster than any framework.
6Understanding Risk
📐
The Risk Formula
Risk = Likelihood × Impact
This simple formula guides every prioritization decision. A highly likely threat with low impact may be less urgent than a rare threat with catastrophic impact. Neither dimension alone tells the full story.
Low Impact
Med Impact
High Impact
High Likelihood
⚠️ Medium
🔴 High
🚨 Critical
Med Likelihood
✅ Low
⚠️ Medium
🔴 High
Low Likelihood
✅ Low
✅ Low
⚠️ Medium
The risk matrix guides prioritization — fix 🚨 Critical items immediately, schedule 🔴 High for the next sprint, track ⚠️ Medium on the backlog, accept or document ✅ Low risks.
7Knowledge Check
✏️ Exercise 2.1
Vulnerability vs Threat
A web app accepts unsanitized SQL queries in its search field. What correctly identifies the vulnerability vs the threat?
✏️ Exercise 2.2
Which CIA property is violated?
An attacker intercepts a payment API request and changes the transaction amount from $10 to $1 before it reaches the server. Which CIA property is primarily violated?
8Module Summary
✅
Key Takeaways
Asset → Threat → Vulnerability → Risk → Control is the chain that connects everything
CIA Triad: Confidentiality (secret), Integrity (accurate), Availability (accessible)
Attack surface: all points where an attacker can interact with your system — minimize it
Trust boundaries: anywhere data crosses from untrusted to trusted — always validate there
Risk = Likelihood × Impact — use this to prioritize what to fix first