Threat modeling methodologies (STRIDE, PASTA) and supply chain risk management

Threat modeling is a structured way to find and prioritize threats to a system, ideally during design when fixes are cheapest. It answers four questions: what are we building, what can go wrong, what are we going to do about it, and did we do a good job. You usually start by decomposing the system into a data flow diagram showing external entities, processes, data stores, data flows and trust boundaries, which are the points where data passes between areas of different trust, such as from the internet into a web tier or from an application into a database.