threat model
threat-model threat-model.yaml
This material is a defensive specification and reference set. It is not an attack tool, a scanner, a certification, or evidence of a completed assessment. It does not automate exploitation; active or state-changing operations require a valid authorization manifest, an in-scope target, an allowed mode, verified preconditions and verified rollback.
Validates against the threat-model schema — try it: POST /v1/validate with {"schema": "threat-model", "document": …}.
The document (YAML original)
version: "1.0"
model_id: TM-DEMO-WEB-001
client_id: client-demo
title: Demo website cross-layer threat and control graph
scope:
environments: [production, recovery]
assets: [demo-domain, demo-vps-01, demo-app, demo-db, demo-backup]
authorization_id: AUTH-DEMO-2026-001
exclusions: [payment-provider, shared-cdn-infrastructure]
assumptions:
- Provider and DNS identities are managed separately from the VPS.
- Testing uses synthetic data and client-owned test accounts.
nodes:
- node_id: internet
kind: network_zone
name: Public internet
environment: external
owner: external
criticality: 1
classification: public
trust_boundary: untrusted
internet_exposed: true
evidence_freshness: n/a
attributes: {}
- node_id: demo-domain
kind: domain
name: security-demo.example.com
environment: production
owner: web-platform-owner
criticality: 5
classification: public
trust_boundary: public-edge
internet_exposed: true
evidence_freshness: 24h
attributes:
tls_required: true
- node_id: demo-app
kind: service
name: Website application
environment: production
owner: application-owner
criticality: 5
classification: confidential
trust_boundary: application
internet_exposed: false
evidence_freshness: 24h
attributes:
runtime_identity: web-runtime
- node_id: demo-db
kind: data_store
name: Client database
environment: production
owner: data-owner
criticality: 5
classification: confidential
trust_boundary: data
internet_exposed: false
evidence_freshness: 24h
attributes:
public_listener: false
- node_id: demo-backup
kind: backup
name: Independent encrypted backup
environment: recovery
owner: recovery-owner
criticality: 5
classification: confidential
trust_boundary: recovery
internet_exposed: false
evidence_freshness: 90d
attributes:
production_delete_rights: false
edges:
- edge_id: EDGE-001
from: internet
relation: connects_to
to: demo-domain
condition: HTTPS on approved public routes
privilege: anonymous
data_class: public
confidence: observed
evidence: [EVIDENCE-TLS-001, EVIDENCE-HTTP-001]
- edge_id: EDGE-002
from: demo-domain
relation: routes_to
to: demo-app
condition: reverse proxy selects the approved host and route
privilege: application-request
data_class: public-and-confidential
confidence: observed
evidence: [EVIDENCE-PROXY-001]
- edge_id: EDGE-003
from: demo-app
relation: writes
to: demo-db
condition: application runtime credentials and approved operations
privilege: application-runtime
data_class: confidential
confidence: inferred
evidence: [EVIDENCE-APP-CONFIG-001]
- edge_id: EDGE-004
from: demo-db
relation: backs_up
to: demo-backup
condition: recovery service identity performs append-only backup
privilege: backup-writer
data_class: confidential
confidence: observed
evidence: [EVIDENCE-BACKUP-001, EVIDENCE-RESTORE-001]
scenarios:
- scenario_id: TS-001
title: Public application compromise attempts to propagate into data and recovery
actor: internet attacker
entry_point: demo-domain
preconditions:
- A reachable application weakness exists on an approved public route.
- The runtime identity can reach the database.
technique_ids: [ATTACK-WEB-APPLICATION]
weakness_ids: [APP-INPUT-OR-AUTHORIZATION-WEAKNESS]
attack_path: [EDGE-001, EDGE-002, EDGE-003, EDGE-004]
effects:
- Unauthorized read or modification of client data.
- Attempted propagation from production into recovery history.
volume:
magnitude: 5
rate: potentially automated after public discovery
direction: toward broader privilege and recovery control
scope: [production-website, client-database, recovery]
depth: attack-path hypothesis with configuration evidence
duration: until weakness, identity, and affected sessions are removed
frequency: reassess on deployment and privilege change
acceleration: unknown
variability: depends on weakness and runtime privileges
detectability: 3
reversibility: time-sensitive through clean restoration
propagation: [public-route, runtime-identity, database-rights, backup-rights]
amplification: [public-exposure, critical-data, credential-overprivilege]
accumulation: repeated drift could recreate the path after remediation
control_links:
- control_id: VPS-008
relation: isolate
target: EDGE-003
expected_effect: Runtime compromise cannot become database administration.
verification: Compare application grants with declared runtime operations.
failure_signal: Runtime identity holds schema-owner or administrative grants.
- control_id: VPS-013
relation: recover
target: demo-backup
expected_effect: Production compromise cannot delete all trusted history.
verification: Restore into an isolated environment and verify application integrity.
failure_signal: Production identity can delete recovery history or restore fails.
- control_id: WEB-INPUT-AUTHZ
relation: prevent
target: EDGE-002
expected_effect: Untrusted input or unauthorized object access cannot cross the route boundary.
verification: Review evidence first, then use approved staging tests with synthetic data.
failure_signal: Expected denial or validation is absent.
verification:
next_uncertain_edge: EDGE-003
least_invasive_method: authenticated configuration and database-grant review
mode: audit
evidence_required: [effective-runtime-identity, effective-database-grants, network-reachability]
stop_conditions: [unexpected-client-data, cross-tenant-access, target-scope-escape]
owner: application-security-owner
status: current
review_triggers:
- public route or DNS change
- application deployment
- runtime identity or database grant change
- backup policy or credential change
- new material finding or incident
- evidence expiry
As JSON
{
"version": "1.0",
"model_id": "TM-DEMO-WEB-001",
"client_id": "client-demo",
"title": "Demo website cross-layer threat and control graph",
"scope": {
"environments": [
"production",
"recovery"
],
"assets": [
"demo-domain",
"demo-vps-01",
"demo-app",
"demo-db",
"demo-backup"
],
"authorization_id": "AUTH-DEMO-2026-001",
"exclusions": [
"payment-provider",
"shared-cdn-infrastructure"
]
},
"assumptions": [
"Provider and DNS identities are managed separately from the VPS.",
"Testing uses synthetic data and client-owned test accounts."
],
"nodes": [
{
"node_id": "internet",
"kind": "network_zone",
"name": "Public internet",
"environment": "external",
"owner": "external",
"criticality": 1,
"classification": "public",
"trust_boundary": "untrusted",
"internet_exposed": true,
"evidence_freshness": "n/a",
"attributes": {}
},
{
"node_id": "demo-domain",
"kind": "domain",
"name": "security-demo.example.com",
"environment": "production",
"owner": "web-platform-owner",
"criticality": 5,
"classification": "public",
"trust_boundary": "public-edge",
"internet_exposed": true,
"evidence_freshness": "24h",
"attributes": {
"tls_required": true
}
},
{
"node_id": "demo-app",
"kind": "service",
"name": "Website application",
"environment": "production",
"owner": "application-owner",
"criticality": 5,
"classification": "confidential",
"trust_boundary": "application",
"internet_exposed": false,
"evidence_freshness": "24h",
"attributes": {
"runtime_identity": "web-runtime"
}
},
{
"node_id": "demo-db",
"kind": "data_store",
"name": "Client database",
"environment": "production",
"owner": "data-owner",
"criticality": 5,
"classification": "confidential",
"trust_boundary": "data",
"internet_exposed": false,
"evidence_freshness": "24h",
"attributes": {
"public_listener": false
}
},
{
"node_id": "demo-backup",
"kind": "backup",
"name": "Independent encrypted backup",
"environment": "recovery",
"owner": "recovery-owner",
"criticality": 5,
"classification": "confidential",
"trust_boundary": "recovery",
"internet_exposed": false,
"evidence_freshness": "90d",
"attributes": {
"production_delete_rights": false
}
}
],
"edges": [
{
"edge_id": "EDGE-001",
"from": "internet",
"relation": "connects_to",
"to": "demo-domain",
"condition": "HTTPS on approved public routes",
"privilege": "anonymous",
"data_class": "public",
"confidence": "observed",
"evidence": [
"EVIDENCE-TLS-001",
"EVIDENCE-HTTP-001"
]
},
{
"edge_id": "EDGE-002",
"from": "demo-domain",
"relation": "routes_to",
"to": "demo-app",
"condition": "reverse proxy selects the approved host and route",
"privilege": "application-request",
"data_class": "public-and-confidential",
"confidence": "observed",
"evidence": [
"EVIDENCE-PROXY-001"
]
},
{
"edge_id": "EDGE-003",
"from": "demo-app",
"relation": "writes",
"to": "demo-db",
"condition": "application runtime credentials and approved operations",
"privilege": "application-runtime",
"data_class": "confidential",
"confidence": "inferred",
"evidence": [
"EVIDENCE-APP-CONFIG-001"
]
},
{
"edge_id": "EDGE-004",
"from": "demo-db",
"relation": "backs_up",
"to": "demo-backup",
"condition": "recovery service identity performs append-only backup",
"privilege": "backup-writer",
"data_class": "confidential",
"confidence": "observed",
"evidence": [
"EVIDENCE-BACKUP-001",
"EVIDENCE-RESTORE-001"
]
}
],
"scenarios": [
{
"scenario_id": "TS-001",
"title": "Public application compromise attempts to propagate into data and recovery",
"actor": "internet attacker",
"entry_point": "demo-domain",
"preconditions": [
"A reachable application weakness exists on an approved public route.",
"The runtime identity can reach the database."
],
"technique_ids": [
"ATTACK-WEB-APPLICATION"
],
"weakness_ids": [
"APP-INPUT-OR-AUTHORIZATION-WEAKNESS"
],
"attack_path": [
"EDGE-001",
"EDGE-002",
"EDGE-003",
"EDGE-004"
],
"effects": [
"Unauthorized read or modification of client data.",
"Attempted propagation from production into recovery history."
],
"volume": {
"magnitude": 5,
"rate": "potentially automated after public discovery",
"direction": "toward broader privilege and recovery control",
"scope": [
"production-website",
"client-database",
"recovery"
],
"depth": "attack-path hypothesis with configuration evidence",
"duration": "until weakness, identity, and affected sessions are removed",
"frequency": "reassess on deployment and privilege change",
"acceleration": "unknown",
"variability": "depends on weakness and runtime privileges",
"detectability": 3,
"reversibility": "time-sensitive through clean restoration",
"propagation": [
"public-route",
"runtime-identity",
"database-rights",
"backup-rights"
],
"amplification": [
"public-exposure",
"critical-data",
"credential-overprivilege"
],
"accumulation": "repeated drift could recreate the path after remediation"
},
"control_links": [
{
"control_id": "VPS-008",
"relation": "isolate",
"target": "EDGE-003",
"expected_effect": "Runtime compromise cannot become database administration.",
"verification": "Compare application grants with declared runtime operations.",
"failure_signal": "Runtime identity holds schema-owner or administrative grants."
},
{
"control_id": "VPS-013",
"relation": "recover",
"target": "demo-backup",
"expected_effect": "Production compromise cannot delete all trusted history.",
"verification": "Restore into an isolated environment and verify application integrity.",
"failure_signal": "Production identity can delete recovery history or restore fails."
},
{
"control_id": "WEB-INPUT-AUTHZ",
"relation": "prevent",
"target": "EDGE-002",
"expected_effect": "Untrusted input or unauthorized object access cannot cross the route boundary.",
"verification": "Review evidence first, then use approved staging tests with synthetic data.",
"failure_signal": "Expected denial or validation is absent."
}
],
"verification": {
"next_uncertain_edge": "EDGE-003",
"least_invasive_method": "authenticated configuration and database-grant review",
"mode": "audit",
"evidence_required": [
"effective-runtime-identity",
"effective-database-grants",
"network-reachability"
],
"stop_conditions": [
"unexpected-client-data",
"cross-tenant-access",
"target-scope-escape"
]
},
"owner": "application-security-owner",
"status": "current"
}
],
"review_triggers": [
"public route or DNS change",
"application deployment",
"runtime identity or database grant change",
"backup policy or credential change",
"new material finding or incident",
"evidence expiry"
]
}