Video lesson: Threat Modeling Starts With Assets and Boundaries

Lesson promise

By the end, the learner should be able to explain the core model for threat modeling starts with assets and boundaries, apply it to a concrete input, and identify when its usual shortcut or guarantee stops applying. This is a recording brief; publish it as a playable lesson after the narration and visual sequence have been produced and reviewed.

Narration draft

Threat modeling is a structured way to ask how a system could be misused or attacked. Begin with assets worth protecting, actors, data flows, and trust boundaries. A boundary marks where assumptions change, such as browser to server, service to database, or tenant to tenant.

A diagram of a file upload can show the browser, API, object store, and image-processing worker. Each crossing raises specific questions: who authenticates the request, how type and size are checked, whether the object name is attacker-controlled, and what privileges the worker receives.

A threat list without mitigations or owners becomes paperwork. Threats depend on the system’s actual deployment and adversaries; generic checklists may miss a risky data flow. Revisit the model when architecture, external exposure, or sensitive data changes.

Visual sequence

1. Put the input and assumptions on screen. Ask the learner to predict the next state before revealing it.
2. Animate the representation and show the operation one transition at a time.
3. Pause at the boundary case in the companion article and compare the result with the invariant.
4. End with the exercise prompt: Draw the trust boundaries for a password-reset flow and identify one abuse case at each boundary, including the email provider callback.

Companion material

Use the article, trace, and interactive concept flow as the learner’s written and visual references. The video remains planned until an actual playable media URL and reviewed transcript are available.