---
name: rt-threat-model
description: "Build threat model for the engagement — identify crown jewel assets, map threat actors, define attack scenarios, and prioritize by business impact. Uses STRIDE and PASTA frameworks. Creates threat-model.md in engagement docs."
---

# rt-threat-model

# Threat Modeling Workflow

## Framework: STRIDE + PASTA hybrid

## Step 1 — Asset Inventory
Identify and classify assets by business value:
| Asset | Type | Business Impact | Data Sensitivity |
|-------|------|-----------------|------------------|
| User authentication system | Auth | CRITICAL | High (credentials) |
| Payment processing | Financial | CRITICAL | PCI-DSS |
| User PII database | Data | HIGH | GDPR/Privacy |
| Admin panel | Control | CRITICAL | Full system access |
| API endpoints | Service | HIGH | Business logic |

## Step 2 — Threat Actor Profiling
Define realistic threat actors for this engagement:

**External Attackers:**
- Script kiddies (automated scanners, known CVEs)
- Cybercriminal groups (ransomware, data theft)
- Competitor espionage (targeted)
- State-sponsored APT (if relevant)

**Internal Threats:**
- Malicious employee
- Compromised contractor
- Accidental data exposure

## Step 3 — STRIDE Analysis
For each component, analyze:
- **S**poofing: Can identity be faked?
- **T**ampering: Can data be modified?
- **R**epudiation: Can actions be denied?
- **I**nformation Disclosure: Can data be leaked?
- **D**enial of Service: Can availability be disrupted?
- **E**levation of Privilege: Can permissions be escalated?

## Step 4 — Attack Scenarios
Define 3-5 realistic attack scenarios:

SCENARIO A — [External Attacker → Data Breach]
Attack path: [Reconnaissance → Initial Access → Privilege Escalation → Data Exfiltration]
Target: [specific assets]
Impact: [business/regulatory impact]

## Step 5 — Prioritization Matrix
Plot scenarios on Likelihood vs Impact grid:
- HIGH likelihood + HIGH impact = Immediate testing priority
- Map to engagement test cases

## Step 6 — Save Threat Model
Create: `_rtexit-output/docs/engagement/threat-model.md`
