Writing tagged: threat-modeling
- 2026-03-15
STRIDE: A Worked Threat Model and Its Limits
A full STRIDE threat model on a vehicle telematics backend, then where the taxonomy breaks down: coverage limits, ranking gaps, and privacy blind spots.
- 2026-03-29
LINDDUN: A Worked Privacy Threat Model and Its Limits
LINDDUN is STRIDE for privacy. A worked pass on a vehicle telematics backend, where it contradicts STRIDE, and where it expands the threat taxonomy.
- 2026-04-19
ISO/SAE 21434 TARA: A Worked Automotive Risk Assessment and Its Limits
A full ISO/SAE 21434 TARA on a telematics backend: all seven Clause 15 activities, then where the method strains and what keeps it alive as the system changes.
- 2026-05-03
DREAD ranks threats by summing five factor scores. A fine way to force an argument about what to fix first, a poor calculator. Worked on a telematics backend.
- 2026-05-10
Embedded Security In Practice: TARA and Lifecycle Plan for the FRDM-MCXN947
A full ISO/SAE 21434 TARA on the FRDM-MCXN947 cast as an ASIL B BCM: threat scenarios, attack paths, risk treatment, and the M2-M8 control roadmap.
- 2026-05-17
Using the Automotive Threat Matrix to threat model a telematics control unit
The Automotive Threat Matrix is ATT&CK for cars. How to scope it to a single ECU, a telematics control unit, and where it helps versus where it stops short.
- 2026-06-07
Threat modeling a RAG chatbot for a bank
A walk through the OWASP LLM Top 10 threat model for a retrieval-only, unauthenticated bank chatbot. Scope the system right and only four threats actually bite.
- 2026-06-14
Threat modeling an authenticated RAG chatbot for a bank
Part 2. Add a login gate and read-only session-scoped tools to the Part 1 bank chatbot, re-run the OWASP LLM Top 10, and the triage nearly inverts.
- 2026-06-26
Automotive threat model as code on Threagile
A tag-driven Threagile model of a composite BEV: 16 custom rules encoding automotive bus-security weaknesses and a multi-hop attack path analyzer.