TRACE: A Threat Modelling Methodology for Distributed, Cloud-First, and Decentralized Organisations (opens in new tab)

Established threat modelling methodologies (STRIDE, PASTA, Trike, OCTAVE, LINDDUN, attack trees, and adversary-behaviour catalogues such as MITRE ATT&CK) were designed for software products and enterprises with a discernible security perimeter, a single owning organisation, and a clean separation between technical and operational risk. Modern organisations violate all three assumptions: they run on cloud and SaaS control planes they do not own, ...