Threat Modeling
Threat modeling is the systematic analysis of a system from an attacker’s perspective: which assets are worth protecting, by which paths could an attacker compromise them, and which countermeasures are appropriate? It is the methodological foundation of normative risk analyses such as the TARA according to ISO/SAE 21434.
The four basic questions
Regardless of the specific methodology, every threat modeling exercise answers the same four questions:
- What are we working on? — Define the system boundary, components, interfaces and data flows. Without a clean scope, the analysis leads nowhere.
- What can go wrong? — Derive threats and attack paths systematically, instead of collecting them by gut feeling.
- What are we going to do about it? — Select countermeasures and treat risks deliberately: reduce, avoid, share or accept with justification.
- Did we do a good enough job? — Review the result and maintain the analysis when the system or the threat landscape changes.
Methods: STRIDE and attack trees
Threat modeling predates today’s automotive standards by a long way — approaches such as STRIDE or attack trees have been established in IT security for decades. STRIDE categorizes threats according to which security property they violate:
| Category | Violated property | Example |
|---|---|---|
| Spoofing | Authenticity | Impersonating a foreign identity towards an ECU |
| Tampering | Integrity | Manipulation of firmware or bus messages |
| Repudiation | Non-repudiation | Actions without provable attribution to an originator |
| Information Disclosure | Confidentiality | Reading out personal or cryptographic data |
| Denial of Service | Availability | Disabling a function or communication link |
| Elevation of Privilege | Authorization | Extending access rights beyond what is intended |
Attack trees complement this view: they hierarchically decompose an attack goal into the individual steps an attacker must combine to achieve it — making visible where a countermeasure has the greatest effect. STRIDE is only one example: which methodology fits depends on domain and system.
Threat modeling and TARA
The TARA according to ISO/SAE 21434 does not reinvent threat modeling. It takes the established discipline and packages it into a normative framework: defined rating scales for damage potential and attack feasibility, a fixed risk matrix, required work products and the obligation to maintain it across the lifecycle. Threat modeling is the way of thinking, the TARA is the auditable form of it, suitable for type approval under UNECE R155. Those who already practise threat modeling have understood the harder part — what is then mainly missing is the traceability in the sense of the standard.
Threat modeling in practice
The most common mistake is treating threat modeling as a one-off workshop. A threat model is a living work product: every architecture change, every new interface and every newly disclosed vulnerability can change attack paths that were previously considered uncritical. The analysis only becomes sustainable when decisions are documented and retrievable — otherwise you start from scratch with every change. Precisely this consistency across system changes is, in practice, harder than the first analysis itself.