Threat Modeling

One hour with the people who know the feature best: product, the dev lead and security. We leave with the threats that matter and who owns each fix.

Inside the hour

Pick a step, or let it play. Every line is what someone in the room actually says.

One feature or service that matters this quarter, not the whole estate.

PRODUCTThis quarter it's partner redemption: users spend points in partner stores.

ATALAIAThen that's the one. Money moves and a partner is involved. Just that flow, today.

DEV LEADIt touches the ledger, the partner API and the redeem screen.

Leaves the roomFeature: redeem points at partner stores

Data flows and trust boundaries on one board, with product, devs and cyber in the room.

DEV LEADThe app calls redeem, we debit the ledger, then ask the partner for a voucher.

ATALAIADraw a dashed line where the partner's network starts. That's a trust boundary.

DEVELOPERAnd the partner calls us back to confirm. That webhook is public.

Leaves the roomBoard: 6 flows, 2 trust boundaries

STRIDE-style prompts, attacker stories, and the questions nobody asked yet.

ATALAIAWhat if someone sends redeem twice, at the same moment?

DEVELOPERTwo debits race. They could spend the same points twice.

CHAMPIONAnd a fake webhook could confirm vouchers nobody paid for.

PRODUCTDouble spend is the one the business can't live with. Rank it first.

Leaves the room4 threats found, 2 ranked high

Every threat leaves as a ticket, an owner, and a test.

DEV LEADIdempotency key on redeem. That ticket is mine, this sprint.

ATALAIASigned webhooks with the partner's key. QA gets the race as a test.

PRODUCTAnd the model goes in the repo. We run the next one without you.

Leaves the room4 tickets, 3 abuse-case tests

This is what the room draws: boxes, arrows, dashed lines where trust changes, and a pin on every threat.

1
Tampering · double spend
Two redeems race between the balance check and the debit. Ticket: idempotency key and a conditional debit.
2
Spoofing · fake confirm
Anyone can call the public webhook. Ticket: signed callbacks, checked against the partner's key.
3
Disclosure · partner key
The partner API key sits in a config file. Ticket: move it to the secret store, rotate it.
4
Abuse · bulk redeems
Bots redeem from many accounts. Ticket: rate limit per user, and a QA abuse test.