[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-seo-656050-105":3,"detail-sidebar-cat-0-en-105":80,"doc-detail-656050-en":130},{"code":4,"msg":5,"data":6},0,"ok",{"site_id":7,"language":8,"slug":9,"title":10,"keywords":11,"description":12,"schema_data":13,"social_meta":73,"head_meta":75,"extra_data":77,"updated_unix":79},105,"en","tactical-threat-modeling-safecode-whitepaper","Tactical Threat Modeling - SAFECode Whitepaper","","Tactical Threat Modeling provides guidance on running effective threat-modeling efforts using a generic, reusable framework. It explains why and when to perform threat modeling, how to update threat models, and common failure modes. The whitepaper covers team composition, threat-modeling scope, methodology and key terminology, including weakness versus vulnerability, and handling complex systems. It further addresses tooling, SDLC integration, examples for web feedback systems and IoT authentication, and approaches within Agile and DevOps practices.",{"@graph":14,"@context":72},[15,34,55],{"@type":16,"itemListElement":17},"BreadcrumbList",[18,23,27,31],{"item":19,"name":20,"@type":21,"position":22},"https://docshare.wps.com","Home","ListItem",1,{"item":24,"name":25,"@type":21,"position":26},"https://docshare.wps.com/document/","Document",2,{"item":28,"name":29,"@type":21,"position":30},"https://docshare.wps.com/document/technology/","Technology",3,{"item":32,"name":10,"@type":21,"position":33},"https://docshare.wps.com/document/tactical-threat-modeling-safecode-whitepaper/656050/",4,{"url":32,"name":10,"@type":35,"image":36,"author":41,"headline":10,"publisher":44,"fileFormat":47,"inLanguage":8,"description":12,"dateModified":48,"datePublished":49,"encodingFormat":47,"isAccessibleForFree":50,"interactionStatistic":51},"DigitalDocument",{"url":37,"@type":38,"width":39,"height":40},"https://docshare.wps.com/thumbnails/tactical-threat-modeling-safecode-whitepaper/656050.png","ImageObject",300,407,{"name":42,"@type":43},"lilac","Person",{"url":19,"name":45,"@type":46},"DocShare","Organization","application/pdf","2026-10-30","2026-10-25",true,{"@type":52,"interactionType":53,"userInteractionCount":33},"InteractionCounter",{"@type":54},"ViewAction",{"@type":56,"mainEntity":57},"FAQPage",[58,64,68],{"name":59,"@type":60,"acceptedAnswer":61},"Why is threat modeling considered a high-return activity in software development?","Question",{"text":62,"@type":63},"Threat modeling is presented as a core practice for building trusted technology and as one of the best “return on investment” activities for identifying and addressing security risks.","Answer",{"name":65,"@type":60,"acceptedAnswer":66},"When should an organization perform threat modeling?",{"text":67,"@type":63},"The document outlines the timing of threat modeling and discusses updating the threat model as development progresses.",{"name":69,"@type":60,"acceptedAnswer":70},"How does the document recommend applying threat modeling in Agile and DevOps environments?",{"text":71,"@type":63},"It includes sections specifically on threat modeling and Agile practices and explains approaches for threat modeling within the DevOps world, including when to do Agile threat modeling.","https://schema.org",{"og:url":32,"og:type":74,"og:title":10,"og:site_name":45,"og:description":12},"article",{"robots":76,"canonical":32},"index,follow",{"doc_id":78,"site_id":7},656050,1793005849,{"code":4,"msg":81,"data":82},"success",[83,87,91,95,100,104,109,114,119,122,126],{"id":22,"doc_module":4,"doc_module_name":25,"category_name":84,"show_sort_weight":85,"slug":86},"Story & Novel",90,"story-novel",{"id":26,"doc_module":4,"doc_module_name":25,"category_name":88,"show_sort_weight":89,"slug":90},"Literature",80,"literature",{"id":33,"doc_module":4,"doc_module_name":25,"category_name":92,"show_sort_weight":93,"slug":94},"Exam",70,"exam",{"id":96,"doc_module":4,"doc_module_name":25,"category_name":97,"show_sort_weight":98,"slug":99},5,"Comic",60,"comic",{"id":101,"doc_module":4,"doc_module_name":25,"category_name":29,"show_sort_weight":102,"slug":103},6,50,"technology",{"id":105,"doc_module":4,"doc_module_name":25,"category_name":106,"show_sort_weight":107,"slug":108},7,"Healthcare",40,"healthcare",{"id":110,"doc_module":4,"doc_module_name":25,"category_name":111,"show_sort_weight":112,"slug":113},8,"Research & Report",30,"research-report",{"id":115,"doc_module":4,"doc_module_name":25,"category_name":116,"show_sort_weight":117,"slug":118},9,"Religion & Spirituality",20,"religion-spirituality",{"id":117,"doc_module":4,"doc_module_name":25,"category_name":120,"show_sort_weight":117,"slug":121},"World Cup","world-cup",{"id":123,"doc_module":4,"doc_module_name":25,"category_name":124,"show_sort_weight":123,"slug":125},10,"Lifestyle","lifestyle",{"id":127,"doc_module":4,"doc_module_name":25,"category_name":128,"show_sort_weight":96,"slug":129},19,"General","general",{"code":4,"msg":81,"data":131},{"doc_id":78,"user_id":132,"nickname":42,"user_avatar":133,"doc_module":4,"category_id":101,"category_name":29,"doc_title":10,"doc_description":12,"doc_content":134,"file_id":135,"file_url":136,"file_type":137,"file_size":138,"view_count":33,"is_deleted":4,"is_public":22,"is_downloadable":22,"audit_status":22,"page_count":139,"language":140,"language_code":8,"site_id":7,"html_lang":8,"table_of_contents":141,"faqs":142,"seo_title":143,"seo_description":12,"update_tm":144,"read_time":145},3985747861865,"https://ap-avatar.wpscdn.com/davatar_29158cc5080c5b710cf443261637dec0","Tactical Threat Modeling  \n© 2017 SAFECode – All Rights Reserved.  \nTable of Contents  \n1. Foreword ............................................................................................................................................... 3  \n2. Why Do Threat Modeling? ................................................................................................................... 4  \n3. When To Do Threat Modeling .............................................................................................................. 4  \n4. Updating the Threat Model .................................................................................................................. 5  \n5. How To Do Threat Modeling ................................................................................................................ 6  \n6. Failing at Threat Modeling ................................................................................................................... 7  \n7. Building a Great Team – People.......................................................................................................... 9  \n7.1. Selecting Good Threat Modelers .................................................................................................. 9  \n8. Threat Modeling Scope ...................................................................................................................... 10  \n9. Methodology ....................................................................................................................................... 11  \n10. Terminology ........................................................................................................................................ 12  \n10.1. Weakness vs. Vulnerability ......................................................................................................... 12  \n11. Handling Complex Systems .............................................................................................................. 12  \n12. Technologies/Tools ............................................................................................................................ 13  \n13. Threat Modeling Within a Development Life Cycle (SDLC) ............................................................ 14  \n14. Threat Modeling Examples ................................................................................................................ 16  \n14.1. Web-based User Feedback System ........................................................................................... 16  \n14.2. Authentication for the Internet of Things (IoT) ............................................................................ 18  \n15. Threat Modeling and Agile Development Practices........................................................................21  \n15.1. When To Do Agile Threat Modeling ............................................................................................ 21  \n15.2. Threat Modeling in the DevOps World ........................................................................................ 22  \n16. In Closing ............................................................................................................................................ 23  \n17. About SAFECode................................................................................................................................ 23  \n18. Glossary .............................................................................................................................................. 24  \n19. Acknowledgments .............................................................................................................................. 24  \n20. References .......................................................................................................................................... 25  \n1. Foreword  \nThe Software Assurance Forum for Excellence in Code (SAFECode) is a non-profit organiz","cbCairaUrsXW4DI9","https://ap.wps.com/l/cbCairaUrsXW4DI9","pdf",1518051,26,"English","# Foreword\n# Why Do Threat Modeling?\n# When To Do Threat Modeling\n# Updating the Threat Model\n# How To Do Threat Modeling\n# Failing at Threat Modeling\n# Building a Great Team – People\n## Selecting Good Threat Modelers\n# Threat Modeling Scope\n# Methodology\n# Terminology\n## Weakness vs. Vulnerability\n# Handling Complex Systems\n# Technologies/Tools\n# Threat Modeling Within a Development Life Cycle (SDLC)\n# Threat Modeling Examples\n## Web-based User Feedback System\n## Authentication for the Internet of Things (IoT)\n# Threat Modeling and Agile Development Practices\n## When To Do Agile Threat Modeling\n## Threat Modeling in the DevOps World\n# In Closing\n# About SAFECode\n# Glossary\n# Acknowledgments\n# References","[{\"question\":\"Why is threat modeling considered a high-return activity in software development?\",\"answer\":\"Threat modeling is presented as a core practice for building trusted technology and as one of the best “return on investment” activities for identifying and addressing security risks.\"},{\"question\":\"When should an organization perform threat modeling?\",\"answer\":\"The document outlines the timing of threat modeling and discusses updating the threat model as development progresses.\"},{\"question\":\"How does the document recommend applying threat modeling in Agile and DevOps environments?\",\"answer\":\"It includes sections specifically on threat modeling and Agile practices and explains approaches for threat modeling within the DevOps world, including when to do Agile threat modeling.\"}]","Tactical Threat Modeling - SAFECode Whitepaper | PDF",1792965917,66]