Threat Modeling: Decide What Deserves Protection

Threat modeling is a structured way to ask what could go wrong before something goes wrong.

The Garden State Cyber curriculum frames it as a risk decision: what are you trying to protect, what threats matter, and how much effort is reasonable to reduce them?

A simple model for this course is:

asset → trust boundary → threat → weakness → impact → control → residual risk

Start with the asset

If you cannot name what matters, every threat feels equally important.

For a smart-home camera, assets might include:

• video stream
• account credentials
• home network access
• stored recordings
• device configuration
• availability of the camera

Draw trust boundaries

A trust boundary is a point where data or control moves between areas with different trust assumptions.

For a fictional smart camera:

user phone → cloud service → home router → camera

Each connection creates questions:

• How is the user authenticated?
• Is traffic protected?
• What happens if the cloud account is compromised?
• Can the camera reach devices it does not need?
• Who can change firmware or settings?

Threat is not certainty

A threat model does not predict the future. It makes assumptions visible.

Use three simple ratings:

• likelihood: low / medium / high
• impact: low / medium / high
• confidence: low / medium / high

Confidence matters because a dramatic scenario built on weak assumptions should not automatically outrank a well-supported everyday risk.

Worked example

Asset: smart speaker account

Threat: unauthorized account access

Weakness: reused password with no MFA

Impact: attacker could change settings or access account-linked information

Control: unique password + MFA

Residual risk: phishing or account recovery may still fail

The control reduces risk. It does not create zero risk.

Build a threat model

Choose one fictional system:

• smart speaker
• baby monitor
• home router
• smart thermostat
• connected doorbell

Create:

1. system diagram
2. asset list
3. trust boundaries
4. five threat scenarios
5. likelihood/impact/confidence ratings
6. one control per scenario
7. residual risk after the control

Prioritize

You have limited time and money. Choose the top three risks.

For each, explain:

• why it ranks above the others
• which assumption drives the rating
• what evidence could change the priority

Do not make every risk high.

Evidence for Lesson 1

Submit your system diagram, risk table, and top-three priorities.

Finish with:

Threat modeling is useful because it forces me to decide ________ before I choose ________.