Threat Model Spec v0.4.0 Enhancement Plan

Status: ✅ Completed (2026-04-19)

All 10 planned enhancements were implemented in v0.4.0.

This document outlines planned enhancements to the threat-model-spec project to provide more comprehensive threat modeling capabilities.

Overview

The current implementation provides strong support for:

• STRIDE threat categories
• MITRE ATT&CK/ATLAS mappings
• OWASP Top 10 (API, LLM, Web)
• CWE mappings
• CVSS scoring
• Asset classification
• DFD, attack-chain, sequence diagrams

The enhancements below address gaps in mitigation tracking, compliance mapping, privacy frameworks, and threat lifecycle management.

Planned Enhancements

1. Mitigations/Countermeasures

Priority: High

Add the ability to document how identified threats are addressed. This is the most commonly requested feature in threat modeling tools.

New Types:

• Mitigation - Links threats to controls with status tracking
• MitigationStatus - Enum: implemented, planned, accepted, transferred, not-applicable

Fields:

• ID, ThreatIDs (links to threats), Control, Status, Owner, Description, VerifiedDate

2. Threat Status Tracking

Priority: High

Track the lifecycle of identified threats from identification through resolution.

New Type:

• ThreatStatus - Enum: identified, analyzing, mitigated, accepted, transferred, monitoring

Integration:

• Add Status field to Attack, Flow (attack type), and STRIDEMapping types

3. Control Framework Mappings

Priority: High

Bridge threat models to security control frameworks for compliance and audit purposes.

New Mappings:

• NISTCSFMapping - NIST Cybersecurity Framework (Identify, Protect, Detect, Respond, Recover)
• CISControlMapping - CIS Critical Security Controls v8
• ISO27001Mapping - ISO 27001 control references

4. Compliance Framework References

Priority: Medium

Map threats and mitigations to regulatory compliance requirements.

New Type:

• ComplianceMapping - Links to SOC 2, PCI-DSS, HIPAA, GDPR, etc.

5. LINDDUN Privacy Framework

Priority: Medium

Support privacy-focused threat modeling alongside STRIDE.

New Types:

• LINDDUNThreat - Enum: L, I, N, D, D2, U, N2
• LINDDUNMapping - Privacy threat mapping with affected data types

6. Threat Actors/Adversary Profiles

Priority: Medium

Document adversary capabilities and motivations for risk-based prioritization.

New Type:

• ThreatActor - Type, sophistication, motivation, resources, TTPs

7. Detection/Response Capabilities

Priority: Medium

Document how threats would be detected and responded to.

New Type:

• Detection - Method, data source, coverage level, response playbook reference

8. Assumptions and Prerequisites

Priority: Low

Document trust assumptions that underlie the threat model.

New Type:

• Assumption - Description, impact if violated, validation status

9. CVE References

Priority: Low

Link threat models to specific known vulnerabilities.

New Mapping:

• CVEMapping - CVE ID, description, affected components, URL

10. Attack Trees Diagram Type

Priority: Low

Add hierarchical threat decomposition visualization.

New Diagram Type:

• attack-tree - Root goal, sub-goals, AND/OR nodes, leaf attacks

Architecture Decisions

Non-Breaking Changes

All additions will be backward-compatible:

• New fields use omitempty tags
• Existing JSON files remain valid
• New types are additive to existing structures

File Organization

New types will be organized as:

• ir/mitigations.go - Mitigation and threat status types
• ir/controls.go - Control framework mappings (NIST CSF, CIS, ISO 27001)
• ir/compliance.go - Compliance framework mappings
• ir/linddun.go - LINDDUN privacy framework
• ir/threat_actor.go - Threat actor profiles
• ir/detection.go - Detection and response types
• ir/assumptions.go - Assumptions and prerequisites

Schema Regeneration

After adding new types:

1. Run go generate ./... to regenerate JSON schemas
2. Update embedded schemas in schema/ directory
3. Validate with schemago lint

Implementation Order

1. Phase 1 (High Priority)
2. Mitigations and MitigationStatus
3. Threat status tracking

4. Control framework mappings (NIST CSF, CIS)

5. Phase 2 (Medium Priority)

6. Compliance framework references
7. LINDDUN privacy framework
8. Threat actors

9. Detection capabilities

10. Phase 3 (Low Priority)

11. Assumptions
12. CVE references
13. Attack trees diagram type

Testing Strategy

• Unit tests for all new types
• Validation tests for new fields
• Integration tests with D2 rendering
• STIX export tests for new mappings
• Example threat models demonstrating new features