Thinking about what could go wrong.
WHAT IT IS
Systematically identifying what an attacker might attempt, before building.
WHAT TO ESTABLISH
What the service holds that is valuable Who could reach it What each could attempt What the consequence would be
WHAT VALUABLE MEANS
Personal data Money or its equivalent Credentials and keys The ability to act as someone else Availability itself
WHAT ENTRY POINTS TO LIST
Every endpoint Every input field File uploads Third-party integrations Administrative interfaces Background job inputs
THAT LAST ONE
Frequently forgotten, and frequently unvalidated.
WHAT TO ASSUME
That any authenticated user may attempt anything any other user can That inputs will be malformed That dependencies will fail
WHAT TO DOCUMENT
The risks identified, and what addresses each.
WHAT TO REVIEW
The model, when the system changes significantly.
WHAT TO PRIORITISE
Risks with high consequence, regardless of assessed likelihood.
