Direct answer
Start with a specific workflow, identify valuable assets and trust boundaries, then describe plausible misuse and the controls that should prevent it. Use that model to choose scoped tests and assign owners for unresolved assumptions.
Describe the normal journey
For an invoice portal, follow a customer from login through invoice selection, export and download. Identify the browser, API, background job and storage service involved. Ask the product owner which roles should perform each action and what data is sensitive.
Reference: NIST SP 800-30 Rev. 1: Guide for Conducting Risk Assessments.
Mark boundaries and assumptions
Record where data moves between customers, roles and services. An export job accepting an invoice identifier crosses an ownership boundary even if the interface hides other customers' records. Document dependencies and assumptions that need confirmation.
- Identify actors, assets and entry points.
- Record expected permissions and sharing rules.
- Mark third-party systems and excluded paths.
Choose relevant tests
Use two isolated test accounts and known invoices to compare an allowed export with a cross-tenant denial. Include the generated download route as well as the initial request. Agree on safe data, authorization and stop conditions before testing.
Reference: NIST SP 800-115: Technical Security Testing and Assessment.
Update the model after change
When a release adds sharing, another client or a new export mechanism, revisit the assumptions and regression cases. Record untested paths and owners rather than describing the model as proof that every threat was found.
Assessment limits
A threat model depends on the information and scenarios considered. It helps focus assessment but is not a complete list of threats or evidence that controls work.
Frequently asked questions
Does a threat model replace testing?
No. It identifies important questions and assumptions; controls still need verification within an authorized scope.
Should a model include third-party services?
Include their role and boundary, while obtaining separate authorization before testing those services.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.