Anthropic-Cybersecurity-Skills/skills/performing-threat-modeling-with-owasp-threat-dragon/references/standards.md

Standards Reference for Threat Modeling

OWASP Threat Modeling Process

1. Decompose the application: Create DFDs showing data flows, trust boundaries, entry points
2. Determine and rank threats: Apply STRIDE per element, rank by DREAD or risk matrix
3. Determine countermeasures and mitigations: Map threats to controls
4. Review and validate: Peer review the model, validate against architecture

NIST SP 800-154: Guide to Data-Centric System Threat Modeling

• Identify data assets and their sensitivity levels
• Map data flows through system components
• Identify threat actors and attack vectors targeting data
• Assess risk based on data exposure and impact
• Document countermeasures protecting data at rest, in transit, and in use

ISO 27005 Risk Assessment Alignment

ISO 27005 Step	Threat Dragon Activity
Context establishment	Define system scope and trust boundaries
Risk identification	STRIDE threat enumeration per DFD element
Risk analysis	Severity rating and likelihood assessment
Risk evaluation	Prioritize threats by risk score
Risk treatment	Define mitigations (mitigate, accept, transfer, avoid)

STRIDE-per-Element Mapping

DFD Element	S	T	R	I	D	E
External Entity	x		x
Process	x	x	x	x	x	x
Data Store		x		x	x
Data Flow		x		x	x

Threat Severity Rating Scale

Rating	Score	Description
Critical	9-10	Immediate exploitation possible, severe business impact
High	7-8	Likely exploitation, significant business impact
Medium	4-6	Possible exploitation, moderate business impact
Low	1-3	Unlikely exploitation or minimal impact