/threat-model

allowed-tools: Task, Bash(kubectl:*), Bash(docker:*), Bash(rg:*), Bash(fd:*), Bash(yq:*), Bash(jq:*), Bash(gdate:*), Read, Write
name: "Threat Model"
description: "Generate comprehensive threat models using STRIDE methodology with parallel analysis and session management"
author: "wcygan"
tags: ["security","model"]
version: "1.0.0"
created_at: "2025-07-14T00:00:00Z"
updated_at: "2025-07-14T00:00:00Z"

Context

• Session ID: !`gdate +%s%N 2>/dev/null || date +%s%N 2>/dev/null || echo "$(date +%s)$(jot -r 1 100000 999999 2>/dev/null || shuf -i 100000-999999 -n 1 2>/dev/null || echo $RANDOM$RANDOM)"`
• Target system: $ARGUMENTS
• Current directory: !`pwd`
• Session state: /tmp/threat-model-state-$SESSION_ID.json
• Checkpoint directory: /tmp/threat-model-checkpoints-$SESSION_ID/
• **Service Discovery**: !`kubectl get services -o json 2>/dev/null | jq -r '.items[]? | "\(.metadata.name): \(.spec.type) (\(.spec.ports[]?.port // "N/A"))"' 2>/dev/null | head -5 || echo "No Kubernetes services detected"`
• **Network Exposure**: !`kubectl get ingress -o json 2>/dev/null | jq -r '.items[]? | "\(.metadata.name): \(.spec.rules[]?.host // "no-host")"' 2>/dev/null | head -3 || echo "No ingress detected"`
• **Security Policies**: !`kubectl get networkpolicies,podsecuritypolicies 2>/dev/null | wc -l | tr -d ' '` policies
• **Container Images**: !`docker images --format "table {{.Repository}}\t{{.Tag}}" 2>/dev/null | head -5 || echo "No Docker daemon or images found"`
• **Open Ports**: !`netstat -tuln 2>/dev/null | grep LISTEN | wc -l | tr -d ' '` listening ports
• **Project Structure**: !`fd "(docker-compose|Dockerfile|k8s|terraform)" . -d 3 | head -5 || echo "No containerization/IaC files detected"`

Your Task

STEP 1: Initialize threat modeling session with state management

• CREATE session directories and state files
• ANALYZE target system from $ARGUMENTS and Context section
• DETERMINE threat modeling scope and complexity
• ESTABLISH checkpoint/resume capability for long analyses

# Initialize session state and directories
mkdir -p /tmp/threat-model-checkpoints-$SESSION_ID
echo '{
  "sessionId": "'$SESSION_ID'",
  "targetSystem": "'$ARGUMENTS'", 
  "phase": "discovery",
  "startTime": "'$(gdate -Iseconds 2>/dev/null || date -Iseconds)'",
  "progress": {},
  "threats": [],
  "mitigations": []
}' > /tmp/threat-model-state-$SESSION_ID.json

# Create symbolic link for latest session
ln -sf /tmp/threat-model-state-$SESSION_ID.json /tmp/threat-model-latest-session.json

STEP 2: Comprehensive security context discovery with parallel analysis

TRY:

IF system_complexity == "distributed" OR infrastructure_detected == "kubernetes":

LAUNCH parallel sub-agents for comprehensive security discovery:

• **Agent 1: Infrastructure Analysis**: Analyze deployment architecture, network topology, and orchestration patterns
• Focus: Docker/K8s configs, network policies, service mesh, load balancers
• Tools: kubectl, docker, yq for configuration analysis
• Output: Infrastructure security baseline and attack surface mapping

• **Agent 2: Application Security**: Examine source code for security patterns and vulnerabilities
• Focus: Authentication, authorization, input validation, cryptography usage
• Tools: rg for code pattern analysis, language-specific security checks
• Output: Application-level threat vectors and security control assessment

• **Agent 3: Configuration Security**: Review security configurations and policies
• Focus: Security headers, TLS configs, secrets management, access controls
• Tools: Configuration file analysis, policy evaluation
• Output: Configuration security gaps and hardening opportunities

• **Agent 4: Dependencies & Supply Chain**: Analyze third-party dependencies and external integrations
• Focus: Package vulnerabilities, external APIs, vendor risk assessment
• Tools: Package manifest analysis, external service discovery
• Output: Supply chain risk assessment and dependency security analysis

• **Agent 5: Compliance & Standards**: Assess regulatory compliance requirements and industry standards
• Focus: GDPR, SOX, HIPAA, PCI-DSS, ISO 27001 applicability assessment
• Tools: Data classification analysis, regulatory requirement mapping
• Output: Compliance gap analysis and regulatory threat implications

ELSE:

EXECUTE streamlined single-service threat analysis:

# Single-service analysis workflow
echo "🔍 Analyzing single-service threat landscape..."
echo "Target: $ARGUMENTS"

STEP 3: STRIDE methodology execution with programmatic analysis

**STRIDE Analysis Workflow:**

# Execute systematic STRIDE analysis
execute_stride_analysis() {
  local session_state="/tmp/threat-model-state-$SESSION_ID.json"
  
  echo "🔒 Executing STRIDE threat analysis..."
  
  # Update session state
  jq '.phase = "stride_analysis" | .progress.stride_started = "'$(gdate -Iseconds 2>/dev/null || date -Iseconds)'"' \
    "$session_state" > "${session_state}.tmp" && mv "${session_state}.tmp" "$session_state"
}

CASE stride_category:

WHEN "Spoofing":

• ANALYZE authentication mechanisms and identity verification
• IDENTIFY potential identity spoofing attack vectors
• ASSESS multi-factor authentication implementation
• EVALUATE certificate-based authentication patterns

WHEN "Tampering":

• EXAMINE data integrity controls and validation mechanisms
• IDENTIFY input validation gaps and injection vulnerabilities
• ASSESS cryptographic integrity protections
• EVALUATE audit trail completeness

WHEN "Repudiation":

• ANALYZE logging and audit trail coverage
• IDENTIFY non-repudiation control gaps
• ASSESS digital signature implementations
• EVALUATE audit log protection mechanisms

WHEN "Information Disclosure":

• EXAMINE data classification and protection controls
• IDENTIFY potential data leakage points
• ASSESS encryption at rest and in transit
• EVALUATE access control effectiveness

WHEN "Denial of Service":

• ANALYZE system resilience an