This trace follows the actual state transitions behind the companion Threat Modeling Starts With Assets and Boundaries. Each step below names its concrete inputs; values illustrate the mechanism and vary across implementations.
Step 1: Name the asset and actor
Threat modeling is a structured way to ask how a system could be misused or attacked. Begin with assets worth protecting, actors, data flows, and trust boundaries. A boundary marks where assumptions change, such as browser to server, service to database, or tenant to tenant.
Step 2: Draw the data flow
A diagram of a file upload can show the browser, API, object store, and image-processing worker. Each crossing raises specific questions: who authenticates the request, how type and size are checked, whether the object name is attacker-controlled, and what privileges the worker receives.
Step 3: Mark a trust boundary
At each boundary, ask who controls the incoming value and which authority is available; derive a concrete misuse case rather than relying on a generic threat list.
Checkpoint: At each boundary, ask who controls the incoming value and which authority is available; derive a concrete misuse case rather than relying on a generic threat list. Confirm this state before advancing to Identify a misuse path.
Step 4: Identify a misuse path
A threat list without mitigations or owners becomes paperwork. Threats depend on the system’s actual deployment and adversaries; generic checklists may miss a risky data flow. Revisit the model when architecture, external exposure, or sensitive data changes.
Step 5: Assign a control and test
Draw the trust boundaries for a password-reset flow and identify one abuse case at each boundary, including the email provider callback.
The trace is done when this check holds: Draw the trust boundaries for a password-reset flow and identify one abuse case at each boundary, including the email provider callback. Compare the outcome against the companion article before making a performance claim.
Hardware, runtime, and observability notes
When tracing Trace: Threat Modeling Starts With Assets and Boundaries in a live production environment (subsystem: execution, primary layer: crypto), keep the following step-level cost model and diagnostic checklist in mind:
- Step 1 (crypto): Name the asset and actor — verifies state invariants before advancing the execution pointer.
- Step 2 (crypto): Draw the data flow — verifies state invariants before advancing the execution pointer.
- Step 3 (crypto): Mark a trust boundary — verifies state invariants before advancing the execution pointer.
- Step 4 (crypto): Identify a misuse path — verifies state invariants before advancing the execution pointer.
- Step 5 (crypto): Assign a control and test — verifies state invariants before advancing the execution pointer.
Every transition across the crypto boundary carries both a direct CPU/memory cost (cache-line fills, descriptor lookups, lock acquisitions, or context switches) and a tail-latency queueing risk under contention. To verify this trace on your own service, capture latency histograms and hardware/kernel counters across each step boundary, compare cold-cache versus warm-cache execution paths, and confirm that error or timeout branches release all acquired descriptors, locks, and buffers cleanly.