Threat Taxonomies

General-purpose frameworks such as STRIDE tell you what kind of thing went wrong. A domain taxonomy tells you where to look. These are threat taxonomies for two parts of a system that the general frameworks reach only partly: the machinery that delivers email, and the software factory that builds and ships software.

Each entry states a threat as a property of a component or a design decision, the principle a sound design follows, and two to four concrete design measures. Each taxonomy is the reference for one of my threat modeling card games, and shares its references with the game.

Email infrastructure

Email Infrastructure Threat Taxonomy: the path a message takes through the nine layers of the email stack

117 threats across nine layers of the email stack, plus 8 structural hazards. The SMTP conversation, sender authentication, DNS, MIME, the delivery pipeline, content scanners, the human-facing layer, client protocols, and operations and storage. The reference for the card game Elevation of Email Flow.

Open the email infrastructure taxonomy · Read the article

Software factory

Software Factory Threat Taxonomy: the two production lines of stations and the structural hazards

221 threats at 17 stations of the software factory, plus 10 structural hazards. From the developer’s laptop and its agents to the last hop into production, including the security controls themselves. The reference for the card game Software Factory.

Open the software factory taxonomy · Read the article

Formats and licence

Each taxonomy has a page per layer or station, and downloads in four formats: a PDF to read and print, an Excel workbook to work in, a SKOS (JSON-LD) file for linked data, and a STIX 2.1 bundle for security tools. Each overview page lists them.

Both taxonomies are licensed under CC BY-NC-ND 4.0 with additional permissions: you can share them freely for non-commercial purposes, threat model with them (including for paying clients), use them internally and for training in any organisation, and quote entries with credit in paid work. Shipping a taxonomy in a product needs permission. The full terms are on each overview page.