<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-privacy-threat-modeling
description: >-
  Perform privacy threat modeling using LINDDUN, STRIDE-privacy, and the
  5-question framework to identify privacy threats in system architectures,
  data flows, and processing activities.
domain: cybersecurity
subdomain: privacy-engineering
tags:
  - threat-modeling
  - linddun
  - stride
  - privacy-threats
  - dfd
  - data-flows
  - risk-assessment
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
  mitre-attack: []
---

# Performing Privacy Threat Modeling

## Overview

Privacy threat modeling systematically identifies threats to personal data within
system architectures using structured methodologies. LINDDUN (Linkability,
Identifiability, Non-repudiation, Detectability, Disclosure, Unawareness,
Non-compliance) provides a privacy-specific taxonomy, while the 5-question framework
anchors threat modeling to real-world adversary capabilities. This skill covers
conducting privacy threat models from data flow diagrams through threat identification,
risk scoring, and mitigation selection.

Mode: `[MODE: PRIVACY]` + `[MODE: ARCHITECT]` — Privacy threat analysis.

## Prerequisites

- Data flow diagrams (DFDs) with trust boundaries
- Understanding of LINDDUN threat taxonomy
- System architecture documentation
- Python 3.10+ for threat modeling tooling
- Knowledge of privacy-enhancing technologies (PETs)

## Key Concepts

### LINDDUN Threat Categories

| Letter | Threat | Description | Example |
|--------|--------|-------------|---------|
| L | Linkability | Linking data items/actions to same subject | Correlating browsing across sites |
| I | Identifiability | Identifying the subject behind data | De-anonymization via quasi-identifiers |
| N | Non-repudiation | Subject cannot deny an action | Immutable audit logs exposing behavior |
| D | Detectability | Detecting that data/action exists | Metadata revealing communication patterns |
| D | Disclosure | Unauthorized access to personal data | Data breach, insider access |
| U | Unawareness | Subject unaware of data collection | Hidden tracking, unclear privacy notices |
| N | Non-compliance | Violating privacy regulations | Missing consent, unlawful transfers |

### 5-Question Framework

```text
1. What are we protecting?      → Data assets, data subjects
2. From whom?                   → Adversary tiers (casual, motivated, state-level)
3. How likely is the threat?    → Based on adversary capability and attack surface
4. What are the consequences?   → Impact on data subjects and organization
5. What is the burden of defense? → Cost/complexity of mitigations
```

### Adversary Tiers

| Tier | Capability | Examples |
|------|-----------|---------|
| Tier 1: Casual | Basic tools, public info | Curious co-worker, script kiddie |
| Tier 2: Motivated | Moderate skill, targeted | Data broker, cybercriminal |
| Tier 3: Resourced | Advanced tools, persistence | APT, nation-state, insider threat |

### CLI Commands

```bash
# Analyze LINDDUN threats for a system component
node scripts/agent.js --action linddun \
  --component "User Profile API" \
  --data-categories "name,email,location" \
  --output /tmp/linddun_analysis.json

# Run 5-question threat model
node scripts/agent.js --action five-questions \
  --asset "Customer database" \
  --adversary "tier-2" \
  --output /tmp/threat_model.json

# Score and prioritize threats
node scripts/agent.js --action score \
  --threats '[{"name":"re-identification","likelihood":"possible","impact":"high"}]' \
  --output /tmp/scored_threats.json

# Generate threat mitigation map
node scripts/agent.js --action mitigations \
  --threats /tmp/scored_threats.json --output /tmp/mitigations.json
```

## Workflow

### Step 1: Define Scope and Assets

```bash
node scripts/agent.js --action five-questions \
  --asset "Health records API" --adversary "tier-2"
```

### Step 2: Create Data Flow Diagram

Map data flows with trust boundaries, external entities, processes, and data stores.

### Step 3: Apply LINDDUN Analysis

```bash
node scripts/agent.js --action linddun \
  --component "Analytics Pipeline" \
  --data-categories "browsing,purchases,location"
```

### Step 4: Score Threats

```bash
node scripts/agent.js --action score \
  --threats '[
    {"name":"linkability via cookies","likelihood":"probable","impact":"high"},
    {"name":"identifiability from quasi-ids","likelihood":"possible","impact":"very-high"}
  ]'
```

### Step 5: Map Mitigations

```bash
node scripts/agent.js --action mitigations --threats /tmp/scored_threats.json
```

## Verification

- [ ] DFD with trust boundaries produced
- [ ] All LINDDUN categories assessed per component
- [ ] Adversary tier identified and justified
- [ ] Threats scored by likelihood and impact
- [ ] Mitigations mapped to each high/critical threat
- [ ] Privacy-enhancing technologies evaluated for each threat
- [ ] Threat model reviewed before system deployment
- [ ] Threat model updated on architecture changes

## References

- [LINDDUN Privacy Threat Modeling](https://www.linddun.org/)
- [LINDDUN GO — Lightweight Assessment](https://www.linddun.org/linddun-go)
- [EFF Threat Modeling Guide](https://ssd.eff.org/module/your-security-plan)
- [OWASP Threat Modeling](https://owasp.org/www-community/Threat_Modeling)
- [Microsoft STRIDE](https://docs.microsoft.com/en-us/azure/security/develop/threat-modeling-tool-threats)
