Web › Module 6 › Lesson 1
Threat Modeling Lite
A06 starts before code: assets, actors, abuse cases — not a fancy diagram tool.
Visual · threat_model_lite
Four boxes on a napkin: what you protect, who can touch it, what they want, what you refuse. as YOUR lab asset — 0.0.1:8773.
Opening
Insecure design is a missing decision — not a missing library pin.
OWASP Top 10:2025 names A06 Insecure Design for failures that lived in the plan: trust assumptions nobody wrote down, workflows that reward the wrong actor, limits that exist only in a slide deck. Injection and misconfiguration matter too — Modules 5 and 2 already taught those — but a perfect parameterized query cannot save a checkout that never asked “who may apply this coupon twice?” Threat modeling lite is Cyberlium’s name for a short, honest pass before you ship: assets, actors, entry points, abuse cases, and controls you can point at. Practice against
1. Assets first: what hurts if it is wrong, missing, or overspent
An asset is anything whose wrongness costs you: money, PII, admin power, inventory, reputation, or uptime. Threat modeling that starts at “draw the AWS logo” skips the sentence that matters: what must stay correct under hostile input. For this module the demo asset is plus the local bind http://127.0.0.1:8773. Name the asset in words a non-engineer understands. If you cannot, you are not ready to claim the design is secure.
A06 shows up when the product assumes goodwill: “users will only buy one gift card,” “admins are always trustworthy,” “the mobile client will never forge this field.” Those assumptions are design choices. Recording them is the first control. Leaving them implicit is how teams ship features that work in happy path demos and fail under adversarial use — still on systems they own, still without needing an exploit kit.
Command guide
A06 Design — Assets first
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ COMMANDS ═══
Command — copy this
SAFE="http://127.0.0.1:8773"
Command — copy this
curl -sS -m 3 -I "$SAFE/" | head -n 12
2. Actors and trust: who is trusted to do what, and where trust stops
Actors are roles: anonymous visitor, logged-in user, support agent, batch job, third-party webhook. Each actor gets a trust budget. The browser is not a vault — anything the client can send, a hostile client can send. The design question is whether the server re-checks every privileged claim. A06 literacy: if a control lives only in the UI (“hide the admin button”), the design already failed. Module 1 called that broken access control at the enforcement layer; A06 is the earlier mistake of never deciding where enforcement must live.
Trust boundaries are the lines where data changes owner or privilege: form → API, API → database, webhook → order state. At each boundary, write one sentence: what is revalidated. Empty sentences fail the lesson. “We trust our SPA” is not a sentence that survives A06 review.
3. Abuse cases: the feature used the way a hostile user would use it
A use case says “apply coupon then pay.” An abuse case says “apply coupon, race a second apply, pay once, keep both discounts,” or “change price in the JSON body,” or “refund after the goods left.” You do not need a bank-steal recipe. You need the habit of asking: what happens if this step runs twice, out of order, or with a forged field? That habit is attack literacy for designers and builders — still practiced only on apps YOU control (DEMO or SAFE loopback).
Write three abuse cases for one feature you own or invent. Each abuse case needs: actor, action, expected failure (deny / limit / alert), and the control that creates that failure. “Hope” is not a control. “WAF” is not a substitute for a business rule. If the only answer is “nobody would do that,” you found an A06 finding in your own plan.
4. Controls you can point at: deny, limit, prove, log — not vibes
After abuse cases, map controls: authentication (who), authorization (may they), integrity checks (was the object forged), rate and quantity limits, idempotency keys, and security logging for the attempt. Topic 10 already covered several of these categories; A06 asks whether the design required them before code started. A control that exists only in a backlog ticket is still insecure design until it ships and is tested on YOUR stack.
Keep the list short. Four real controls beat twenty aspirational ones. Your note file will hold assets, actors, three abuse cases, and named controls — chmod 600 under cyberlium-lab. Empty ethics lines fail. Foreign targets fail. Router-admin hydra fails. Exploit scripts fail.
5. Wrong vs right: skip the plan vs write abuse cases you own
Same word “security,” opposite job. Right never needs a stranger’s production URL — or a home router login — to prove design literacy.
Wrong
Skip modeling because “we will harden later.” Probe a café checkout “to find logic bugs.” Hydra the router at 192.168.0.1. nmap the LAN. Treat WAF rules as the design. Store live secrets in the note. Claim official OWASP certification from this path.
Right
0.0.1:8773). Name assets, actors, trust boundaries, three abuse cases, and controls on a feature YOU own or invent. Lock threat-model-notes.txt (chmod 600). Next: Business Logic Flaws.
6. Hands-on: identify DEMO, then threat-model-notes.txt
Create $HOME/cyberlium-lab if needed. Identify the course demo URL first. If curl shows TP-Link/Netgear/Huawei “Router Admin,” that host is OUT — switch to
Mission: threat-model-notes.txt (mode 600)
1) 0.0.1:8773 after starting a06_threat_model_toy.py.2) Pick one feature YOU own or invent. List assets, actors, three abuse cases, and named controls. 3) chmod 600 $HOME/cyberlium-lab/threat-model-notes.txt. No LAN nmap. No hydra. No foreign targets.
Stuck? Ask Cyberlium AI Mentor
If “threat modeling” still feels like a consulting slide deck, ask for a hint — not a target list. Try: "Hint only: how A06 Insecure Design differs from injection; how to write one abuse case with a named control; why a router login at 192.168.0.1 is OUT OF SCOPE; where locked notes live?" You still fill threat-model-notes.txt on a feature you own.
You can now say A06 Insecure Design out loud as a missing design decision: assets, actors, abuse cases, and controls written before hope — with practical identify curls on the course demo URL and a SAFE loopback bind. This is original Cyberlium teaching mapped to OWASP Top 10:2025 — not official OWASP certification. Next — Business Logic Flaws — when the happy path is correct and the money path is not.
Knowledge Check
APPLY: A teammate says “we will add security after the demo; WAF will catch logic abuse.” What is A06 Insecure Design here, and what do you do?
Multiple choice
Knowledge Check
APPLY: True or False: Hiding the admin button in the SPA is enough trust control because users will not forge API fields.
True or False
Knowledge Check
APPLY: curl of http://192.168.0.1/ shows a TP-Link/Netgear “Router Admin” login. What is in scope for this A06 demo?
Multiple choice