--- title: "Threat Modeling — Canonical Reference · VORNAC Research" description: "STRIDE, LINDDUN, attack-tree, and the Diamond model as a structured note-taking template — paired with the preventive and responsive control maps over the attack lifecycle." url: https://www.vornac.com/en/research/threat-intelligence/threat-modeling-canon lang: en published: 2026-06-02 updated: 2026-06-02 alternate_de: https://www.vornac.com/research/threat-intelligence/threat-modeling-canon --- [Research Index](https://www.vornac.com/en/research) / [5 · Threat Intelligence & Adversary Modeling](https://www.vornac.com/en/research/threat-intelligence) / Threat Modeling — Canonical Reference Background · [5 Threat Intelligence & Adversary Modeling](https://www.vornac.com/en/research/threat-intelligence) # Threat Modeling — Canonical Reference. STRIDE, LINDDUN, attack-tree, and the Diamond model as a structured note-taking template — paired with the preventive and responsive control maps over the attack lifecycle. ## STRIDE — per-component threat enumeration - **S**poofing — identity claim is fake. Defense: authentication. - **T**ampering — data modified in transit or at rest. Defense: integrity (signatures, MACs). - **R**epudiation — actor denies action. Defense: logging + non-repudiation (signed actions). - **I**nformation disclosure — confidential data leaked. Defense: encryption + access control. - **D**enial of service — availability degraded. Defense: rate-limiting, redundancy, isolation. - **E**levation of privilege — actor gains rights they shouldn't. Defense: authorization, least privilege. - **Workflow.** Draw data-flow diagram → identify trust boundaries → for each element crossing a boundary, walk STRIDE → record threat + mitigation + residual risk. ## LINDDUN — privacy threats - **L**inkability — different actions can be linked to same actor. - **I**dentifiability — pseudonymous data can be re-identified. - **N**on-repudiation — actor cannot deny an action (privacy reads this as harm, not as benefit). - **D**etectability — actor can be detected as having performed an action. - **D**isclosure of information — see STRIDE-I. - **U**nawareness — user doesn't know what data is collected/processed. - **N**on-compliance — system violates regulation (GDPR, CCPA). - **When.** Anywhere personal data flows. Right framework for any GDPR/DPIA work. ## Attack trees - **Root = adversary objective.** E.g. "exfiltrate customer PII". - **OR-nodes for alternative paths.** Phish admin OR exploit web app OR insider. - **AND-nodes for required combinations.** Phish admin AND bypass MFA. - **Leaf evaluation.** Per leaf: cost, skill, time, detection probability. Cheapest unmitigated leaf = highest-priority defense. - **Mark deployed defenses.** Defended leaves cut off subtrees; remaining paths show actual residual exposure. ## Diamond model - **Four vertices.** Adversary, Capability, Infrastructure, Victim. Two meta-features: socio-political (why), technology (how). - **Pivot relationships.** One vertex is anchor (e.g. captured C2 IP = Infrastructure); pivot to other vertices via what's known about that IP (used by which actor? what tooling? hit which victims?). - **Discipline.** Every claim tagged with source + confidence. Vertices without source = "unknown", not best-guess. Best-guess in a Diamond is what produces wrong attribution. ## Preventive vs responsive controls across the lifecycle - **Recon / weaponization.** Preventive: minimize external attack surface, OSINT cleanup. Responsive: monitor for reconnaissance patterns (CT log monitoring of own certs, honeypot subdomains). - **Delivery.** Preventive: mail gateway, web gateway, USB controls. Responsive: sandbox detonation alerts, EDR exec telemetry. - **Exploitation.** Preventive: patching, exploit mitigations (CFG, CET, ASLR). Responsive: EDR exploit-behavior detections. - **Installation.** Preventive: app allowlisting, code signing enforcement. Responsive: persistence-location monitoring (autoruns, scheduled tasks). - **Command & control.** Preventive: egress filtering, DNS sinkhole for known-bad. Responsive: NTA detecting C2 beaconing patterns. - **Actions on objective.** Preventive: data-loss prevention, segmentation. Responsive: anomalous-data-egress detection, deception (canary files). **Rule of thumb**Pick the framework by the question you're answering, not by familiarity. STRIDE for component-level threat enumeration. Attack tree for "is X reachable". LINDDUN for privacy. Diamond for incident analysis. Using STRIDE for an incident write-up wastes effort and produces a bad write-up. Domain [5 · Threat Intelligence & Adversary Modeling](https://www.vornac.com/en/research/threat-intelligence) Tier Background Engagement phases ReconKnown CVEs Published 2 June 2026 Looking up an acronym? [Open the Glossary](https://www.vornac.com/en/glossary) ## Related notes in this domain - [Featured OSINT — Recon Mindmap](https://www.vornac.com/en/research/threat-intelligence/osint-mindmap) - [Background APT Operations — Reference](https://www.vornac.com/en/research/threat-intelligence/apt-operations) - [Background Red Team Planning & Intel Analysis](https://www.vornac.com/en/research/threat-intelligence/red-team-planning) - [Background Email & Fraud — Investigation Reference](https://www.vornac.com/en/research/threat-intelligence/email-and-fraud-forensics) [Previous note OSINT — Recon Mindmap](https://www.vornac.com/en/research/threat-intelligence/osint-mindmap) [Back to domain](https://www.vornac.com/en/research/threat-intelligence) [Next note APT Operations — Reference](https://www.vornac.com/en/research/threat-intelligence/apt-operations) From reference to evidence ## Run this against your own environment.