wardley-maps.sgit.ai / Resources / Using Wardley Mapping for Optimizing Your Threat Modeling Strategy

Using Wardley Mapping for Optimizing Your Threat Modeling Strategy

Reference & derivative Live reference (applied, security)

What it is

The most concrete, most actionable security application I found, and the one to build a security page around. Van Stein's argument is that teams jump straight into STRIDE and drown in detail, and that a Wardley map should sit above the threat model as a targeting layer. The method: build a high-level map of the system positioning components by commoditisation with the responsible team marked for each layer; then apply Wardley's opportunity framework — validate assumptions at team boundaries, marked with triangles, because handoff points between teams are "bias hotspots"; assess organisational capability and expertise gaps that threaten secure implementation; and challenge the attack surface by asking which components could be eliminated entirely rather than defended. Only then run STRIDE, on the areas the map identified. He works a concrete example of an API system with DNS, WAF, proxies and load balancers, and includes four maps with annotated problem areas. His own framing: "it hopefully will provide you more overview on where to apply STRIDE without getting lost in dirty details."

Limitations

Vendor blog, all rights reserved, so nothing can be mirrored. One consultant's method, not a validated framework. Assumes STRIDE familiarity. The maps are illustrative rather than from a real engagement.

The details