A threat model is four questions you can ask about anything, a simple picture of the system, and a checklist of what can go wrong. This set checks that you know the four questions, the shapes in a data flow diagram, and what STRIDE stands for, and that you finish with a decision rather than a worry.
Each one is marked as you go, and the explanation arrives straight after, which is
the part worth reading.
4 questions, marked as you go.
Tasks
These need your own device. Run the command in Termux, then paste what it printed.
The marking looks at what the output means, so spacing, version numbers and
ordering do not matter. If you have not installed anything yet, the
lesson covers the setup.
Write a threat model you can act on
A threat model is four questions with a decision beside each answer. This writes a short model for a Termux install with sshd and a folder of notes, then reads it back and counts the lines. Notice that every item ends in a decision.
Run this in Termux
On your own device. Nothing on this page executes it. The command runs in
your terminal, and this box only reads what you paste back.
mkdir -p ~/threatmodel; printf "asset: sshd on port 8022\nthreat: an exposed listener anyone on the network can reach\nrisk: medium, and only while the listener runs\ndecision: keep sshd stopped unless I am using it\n" > ~/threatmodel/sshd.txt; cat ~/threatmodel/sshd.txt; echo "---"; wc -l < ~/threatmodel/sshd.txt
Each line is one field of the model: the asset, the threat, the risk, and the decision.
the model names an asset
it names what could go wrong
every item carries a decision
the commands actually ran
What a good answer looks like
Four lines naming the asset, the threat, the risk and the decision, then a divider, then a line count. The important part is the decision line: a model with no decisions is only a worry list. Your own model would name different assets, but each one should still end in a decision to fix it, accept it, or watch it.
Marking your own work
Both halves of this are checked in your browser, with no server involved, so nothing
stops you from pasting output you did not run. The tasks are written so that the
easiest way to pass one is to actually do it and read the result, which is the whole
intention.