Threat modeling becomes useful when a design discussion produces security decisions that a team can check. The OWASP Threat Modeling Cheat Sheet connects system understanding, threat discovery, responses and validation. This evergreen guide uses a hypothetical password-reset feature.
Choose a flow people can explain
Sketch the browser, reset endpoint, account database and email provider. Show where reset requests, tokens and new passwords travel, and where trust changes. Record assumptions, including who controls the mailbox. Ask the feature owner to check the sketch against the intended implementation.
Turn categories into concrete abuse paths
Microsoft’s STRIDE guidance groups threats into spoofing, tampering, repudiation, information disclosure, denial of service and elevation of privilege. These categories are prompts for investigating a design. Assigning a category does not establish that a vulnerability exists or determine its severity.
For the reset flow, ask whether a response reveals registered addresses, whether a modified request could target another account and whether repeated submissions could flood a mailbox. Consider what an investigator could establish if someone disputed a reset. These are hypotheses to investigate, rather than findings from a tested application.
Prioritize the scenarios using the specific system’s exposure and consequences. A credible route to account takeover deserves a different response from an unlikely failure with limited impact. Record the assumptions behind that judgment so another reviewer can challenge them.
Write a requirement someone can test
OWASP’s password-reset guidance provides concrete controls: use cryptographically generated tokens, bind them to an individual account, expire them and invalidate them after use. Keep responses consistent for existing and nonexistent accounts, address response-time differences and protect against excessive submissions.
Translate those controls into acceptance checks. A token issued for one test account must fail for another. A consumed or expired token must fail. Compare messages and response-time behavior for existing and nonexistent accounts; one matching response is insufficient to rule out enumeration. Exercise submission limits in an authorized test environment.
Record each scenario’s affected flow, attacker action, consequence, response, owner and verification evidence. Explain any accepted residual risk. OWASP recommends stakeholder review and updates as the system changes. Revisit the model when the reset workflow or its dependencies change.
