Threat Modeling & Forensics
Threat modeling and forensics are two ends of the same timeline. Threat modeling happens before anything goes wrong - systematically thinking through how an attacker could actually get in, so the gaps can be closed in advance. Forensics happens after something has gone wrong - reconstructing what actually happened, so the gap that got used can be closed and learned from. One is prevention through imagination; the other is response through investigation. A mature security program does both.
Contents
What threat modeling actually is
Threat modeling is a structured way of asking "how could someone actually attack this?" before they do, so the answer can inform what gets built or fixed. A basic threat model identifies what you're protecting (the asset), who might attack it and why (the threat actor and motivation), how they could realistically do it (the attack vector), and what happens if they succeed (the impact).
This is the same reasoning this site's own assessment applies to compounding-risk findings - not just "is MFA enabled," but "what happens to an attacker's plan if it isn't."
Why it's worth doing deliberately
Every organization does some threat modeling whether they call it that or not - deciding where to put a firewall is an implicit threat model. Doing it deliberately catches what informal intuition misses: the compounding combination of two individually-minor gaps, the assumption nobody questioned because it was never written down, the attack path that only becomes obvious once it's drawn out.
How organizations do it - STRIDE, PASTA, and other real methodologies
Real, named methodologies - none require a dedicated team to start using, even a small organization can walk through STRIDE's six categories against its most important system in an afternoon:
- STRIDE (Microsoft's framework) - Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege - a checklist-style lens for walking through a system component by component.
- PASTA (Process for Attack Simulation and Threat Analysis) - a risk-centric, multi-stage methodology tying technical threats back to actual business impact.
- Attack trees - a visual technique: a goal at the root ("compromise the customer database"), with branches showing every way an attacker could reach it.
- DREAD - often paired with STRIDE for scoring: Damage, Reproducibility, Exploitability, Affected users, Discoverability.
What digital forensics actually is
The disciplined process of investigating a security incident after the fact - figuring out what happened, how the attacker got in, what they touched, and when - in a way that holds up to scrutiny, not just a guess based on what looks unusual. "Disciplined" matters: forensics isn't just looking around a compromised system, it's preserving evidence carefully enough that conclusions drawn from it are actually reliable.
Why forensics matters, even for a small organization
Without it, an incident becomes "something bad happened, we cleaned it up, we're not entirely sure how." Forensics turns "we think we fixed it" into "we know what happened and we know it's closed."
Forensics basics for a general IT administrator
You don't need to be a specialist to get the fundamentals right:
- The order of volatility matters - capture the most fragile evidence first (what's in memory, active network connections) before more durable evidence (files on disk).
- Don't investigate directly on the live, compromised system if avoidable - isolate it from the network (rather than powering it off immediately, which destroys memory-resident evidence) and work from a copy where possible.
- Preserve logs immediately - don't let routine log rotation quietly delete the most useful record of what happened.
- Keep a simple, timestamped record of what was observed and when - a lightweight version of "chain of custody."
- Know when to call in outside help, and don't be afraid to. A genuinely serious incident (ransomware, confirmed sensitive-data breach, anything with legal/regulatory exposure) usually calls for a professional incident-response firm.