= Threat model
A <threat model> states what is being protected, which adversarial actions are considered, which assumptions are trusted and which security properties must hold. A <trust boundary> marks where data or authority crosses between differently trusted parts. The model guides design and evaluation rather than treating every possible failure as equally relevant.<Microsoft Threat Modeling Tool threats>[threat questions and STRIDE categories]{ref}
For example, encrypting a <database> backup protects its contents from someone who obtains only the stored backup. That mechanism does not by itself stop a logged-in administrator from replacing live records, or an endpoint from disclosing data after <decryption>. Adding those capabilities to the attacker changes the model and may require <authorization> checks, integrity protection and audit evidence. An explicit model makes the scope of a security claim inspectable.
Back to article page
