{"id":"threat-model","filename":"threat-model.yaml","schema":"threat-model","document":{"version":"1.0","model_id":"TM-DEMO-WEB-001","client_id":"client-demo","title":"Demo website cross-layer threat and control graph","scope":{"environments":["production","recovery"],"assets":["demo-domain","demo-vps-01","demo-app","demo-db","demo-backup"],"authorization_id":"AUTH-DEMO-2026-001","exclusions":["payment-provider","shared-cdn-infrastructure"]},"assumptions":["Provider and DNS identities are managed separately from the VPS.","Testing uses synthetic data and client-owned test accounts."],"nodes":[{"node_id":"internet","kind":"network_zone","name":"Public internet","environment":"external","owner":"external","criticality":1,"classification":"public","trust_boundary":"untrusted","internet_exposed":true,"evidence_freshness":"n/a","attributes":{}},{"node_id":"demo-domain","kind":"domain","name":"security-demo.example.com","environment":"production","owner":"web-platform-owner","criticality":5,"classification":"public","trust_boundary":"public-edge","internet_exposed":true,"evidence_freshness":"24h","attributes":{"tls_required":true}},{"node_id":"demo-app","kind":"service","name":"Website application","environment":"production","owner":"application-owner","criticality":5,"classification":"confidential","trust_boundary":"application","internet_exposed":false,"evidence_freshness":"24h","attributes":{"runtime_identity":"web-runtime"}},{"node_id":"demo-db","kind":"data_store","name":"Client database","environment":"production","owner":"data-owner","criticality":5,"classification":"confidential","trust_boundary":"data","internet_exposed":false,"evidence_freshness":"24h","attributes":{"public_listener":false}},{"node_id":"demo-backup","kind":"backup","name":"Independent encrypted backup","environment":"recovery","owner":"recovery-owner","criticality":5,"classification":"confidential","trust_boundary":"recovery","internet_exposed":false,"evidence_freshness":"90d","attributes":{"production_delete_rights":false}}],"edges":[{"edge_id":"EDGE-001","from":"internet","relation":"connects_to","to":"demo-domain","condition":"HTTPS on approved public routes","privilege":"anonymous","data_class":"public","confidence":"observed","evidence":["EVIDENCE-TLS-001","EVIDENCE-HTTP-001"]},{"edge_id":"EDGE-002","from":"demo-domain","relation":"routes_to","to":"demo-app","condition":"reverse proxy selects the approved host and route","privilege":"application-request","data_class":"public-and-confidential","confidence":"observed","evidence":["EVIDENCE-PROXY-001"]},{"edge_id":"EDGE-003","from":"demo-app","relation":"writes","to":"demo-db","condition":"application runtime credentials and approved operations","privilege":"application-runtime","data_class":"confidential","confidence":"inferred","evidence":["EVIDENCE-APP-CONFIG-001"]},{"edge_id":"EDGE-004","from":"demo-db","relation":"backs_up","to":"demo-backup","condition":"recovery service identity performs append-only backup","privilege":"backup-writer","data_class":"confidential","confidence":"observed","evidence":["EVIDENCE-BACKUP-001","EVIDENCE-RESTORE-001"]}],"scenarios":[{"scenario_id":"TS-001","title":"Public application compromise attempts to propagate into data and recovery","actor":"internet attacker","entry_point":"demo-domain","preconditions":["A reachable application weakness exists on an approved public route.","The runtime identity can reach the database."],"technique_ids":["ATTACK-WEB-APPLICATION"],"weakness_ids":["APP-INPUT-OR-AUTHORIZATION-WEAKNESS"],"attack_path":["EDGE-001","EDGE-002","EDGE-003","EDGE-004"],"effects":["Unauthorized read or modification of client data.","Attempted propagation from production into recovery history."],"volume":{"magnitude":5,"rate":"potentially automated after public discovery","direction":"toward broader privilege and recovery control","scope":["production-website","client-database","recovery"],"depth":"attack-path hypothesis with configuration evidence","duration":"until weakness, identity, and affected sessions are removed","frequency":"reassess on deployment and privilege change","acceleration":"unknown","variability":"depends on weakness and runtime privileges","detectability":3,"reversibility":"time-sensitive through clean restoration","propagation":["public-route","runtime-identity","database-rights","backup-rights"],"amplification":["public-exposure","critical-data","credential-overprivilege"],"accumulation":"repeated drift could recreate the path after remediation"},"control_links":[{"control_id":"VPS-008","relation":"isolate","target":"EDGE-003","expected_effect":"Runtime compromise cannot become database administration.","verification":"Compare application grants with declared runtime operations.","failure_signal":"Runtime identity holds schema-owner or administrative grants."},{"control_id":"VPS-013","relation":"recover","target":"demo-backup","expected_effect":"Production compromise cannot delete all trusted history.","verification":"Restore into an isolated environment and verify application integrity.","failure_signal":"Production identity can delete recovery history or restore fails."},{"control_id":"WEB-INPUT-AUTHZ","relation":"prevent","target":"EDGE-002","expected_effect":"Untrusted input or unauthorized object access cannot cross the route boundary.","verification":"Review evidence first, then use approved staging tests with synthetic data.","failure_signal":"Expected denial or validation is absent."}],"verification":{"next_uncertain_edge":"EDGE-003","least_invasive_method":"authenticated configuration and database-grant review","mode":"audit","evidence_required":["effective-runtime-identity","effective-database-grants","network-reachability"],"stop_conditions":["unexpected-client-data","cross-tenant-access","target-scope-escape"]},"owner":"application-security-owner","status":"current"}],"review_triggers":["public route or DNS change","application deployment","runtime identity or database grant change","backup policy or credential change","new material finding or incident","evidence expiry"]},"yaml":"version: \"1.0\"\nmodel_id: TM-DEMO-WEB-001\nclient_id: client-demo\ntitle: Demo website cross-layer threat and control graph\nscope:\n  environments: [production, recovery]\n  assets: [demo-domain, demo-vps-01, demo-app, demo-db, demo-backup]\n  authorization_id: AUTH-DEMO-2026-001\n  exclusions: [payment-provider, shared-cdn-infrastructure]\nassumptions:\n  - Provider and DNS identities are managed separately from the VPS.\n  - Testing uses synthetic data and client-owned test accounts.\nnodes:\n  - node_id: internet\n    kind: network_zone\n    name: Public internet\n    environment: external\n    owner: external\n    criticality: 1\n    classification: public\n    trust_boundary: untrusted\n    internet_exposed: true\n    evidence_freshness: n/a\n    attributes: {}\n  - node_id: demo-domain\n    kind: domain\n    name: security-demo.example.com\n    environment: production\n    owner: web-platform-owner\n    criticality: 5\n    classification: public\n    trust_boundary: public-edge\n    internet_exposed: true\n    evidence_freshness: 24h\n    attributes:\n      tls_required: true\n  - node_id: demo-app\n    kind: service\n    name: Website application\n    environment: production\n    owner: application-owner\n    criticality: 5\n    classification: confidential\n    trust_boundary: application\n    internet_exposed: false\n    evidence_freshness: 24h\n    attributes:\n      runtime_identity: web-runtime\n  - node_id: demo-db\n    kind: data_store\n    name: Client database\n    environment: production\n    owner: data-owner\n    criticality: 5\n    classification: confidential\n    trust_boundary: data\n    internet_exposed: false\n    evidence_freshness: 24h\n    attributes:\n      public_listener: false\n  - node_id: demo-backup\n    kind: backup\n    name: Independent encrypted backup\n    environment: recovery\n    owner: recovery-owner\n    criticality: 5\n    classification: confidential\n    trust_boundary: recovery\n    internet_exposed: false\n    evidence_freshness: 90d\n    attributes:\n      production_delete_rights: false\nedges:\n  - edge_id: EDGE-001\n    from: internet\n    relation: connects_to\n    to: demo-domain\n    condition: HTTPS on approved public routes\n    privilege: anonymous\n    data_class: public\n    confidence: observed\n    evidence: [EVIDENCE-TLS-001, EVIDENCE-HTTP-001]\n  - edge_id: EDGE-002\n    from: demo-domain\n    relation: routes_to\n    to: demo-app\n    condition: reverse proxy selects the approved host and route\n    privilege: application-request\n    data_class: public-and-confidential\n    confidence: observed\n    evidence: [EVIDENCE-PROXY-001]\n  - edge_id: EDGE-003\n    from: demo-app\n    relation: writes\n    to: demo-db\n    condition: application runtime credentials and approved operations\n    privilege: application-runtime\n    data_class: confidential\n    confidence: inferred\n    evidence: [EVIDENCE-APP-CONFIG-001]\n  - edge_id: EDGE-004\n    from: demo-db\n    relation: backs_up\n    to: demo-backup\n    condition: recovery service identity performs append-only backup\n    privilege: backup-writer\n    data_class: confidential\n    confidence: observed\n    evidence: [EVIDENCE-BACKUP-001, EVIDENCE-RESTORE-001]\nscenarios:\n  - scenario_id: TS-001\n    title: Public application compromise attempts to propagate into data and recovery\n    actor: internet attacker\n    entry_point: demo-domain\n    preconditions:\n      - A reachable application weakness exists on an approved public route.\n      - The runtime identity can reach the database.\n    technique_ids: [ATTACK-WEB-APPLICATION]\n    weakness_ids: [APP-INPUT-OR-AUTHORIZATION-WEAKNESS]\n    attack_path: [EDGE-001, EDGE-002, EDGE-003, EDGE-004]\n    effects:\n      - Unauthorized read or modification of client data.\n      - Attempted propagation from production into recovery history.\n    volume:\n      magnitude: 5\n      rate: potentially automated after public discovery\n      direction: toward broader privilege and recovery control\n      scope: [production-website, client-database, recovery]\n      depth: attack-path hypothesis with configuration evidence\n      duration: until weakness, identity, and affected sessions are removed\n      frequency: reassess on deployment and privilege change\n      acceleration: unknown\n      variability: depends on weakness and runtime privileges\n      detectability: 3\n      reversibility: time-sensitive through clean restoration\n      propagation: [public-route, runtime-identity, database-rights, backup-rights]\n      amplification: [public-exposure, critical-data, credential-overprivilege]\n      accumulation: repeated drift could recreate the path after remediation\n    control_links:\n      - control_id: VPS-008\n        relation: isolate\n        target: EDGE-003\n        expected_effect: Runtime compromise cannot become database administration.\n        verification: Compare application grants with declared runtime operations.\n        failure_signal: Runtime identity holds schema-owner or administrative grants.\n      - control_id: VPS-013\n        relation: recover\n        target: demo-backup\n        expected_effect: Production compromise cannot delete all trusted history.\n        verification: Restore into an isolated environment and verify application integrity.\n        failure_signal: Production identity can delete recovery history or restore fails.\n      - control_id: WEB-INPUT-AUTHZ\n        relation: prevent\n        target: EDGE-002\n        expected_effect: Untrusted input or unauthorized object access cannot cross the route boundary.\n        verification: Review evidence first, then use approved staging tests with synthetic data.\n        failure_signal: Expected denial or validation is absent.\n    verification:\n      next_uncertain_edge: EDGE-003\n      least_invasive_method: authenticated configuration and database-grant review\n      mode: audit\n      evidence_required: [effective-runtime-identity, effective-database-grants, network-reachability]\n      stop_conditions: [unexpected-client-data, cross-tenant-access, target-scope-escape]\n    owner: application-security-owner\n    status: current\nreview_triggers:\n  - public route or DNS change\n  - application deployment\n  - runtime identity or database grant change\n  - backup policy or credential change\n  - new material finding or incident\n  - evidence expiry\n"}