Die Beispieldokumente und Projektpläne sind bewusst nur auf Englisch veröffentlicht: Sie sind Vorlagen zum Übernehmen, und eine Übersetzung wäre nicht die Fassung, mit der Sie am Ende arbeiten.
Fiktives Beispiel. Die ACME Embedded GmbH, ihre Produkte, Nachweise und Dokument-IDs sind zur Veranschaulichung erfunden. Nutzen Sie das als strukturelles Vorbild, nicht als unverändert zu übernehmende Vorlage — und nicht als Rechtsberatung.
SEC-TM-S300 — Threat Model (Pre-Development)
| Document ID | SEC-TM-S300, rev. 0.1 |
| Product | SensorNode S300 (project P-2026-04) |
| Reference | CRA Annex I I(1); companion to risk assessment SEC-RA-S300 v0.1 |
| Methodology | STRIDE per element on a data-flow diagram; attacker profiling per SDL-TMP-011. Methodology is documented here explicitly as required. |
| Participants | PSL (moderator), Team Lead Firmware, HW Engineer, QA — workshop 2026-07-15, 3 h |
| Approved by | Product Security Lead |
1. Methodology (as applied)
- Draw the data-flow diagram (DFD) of the planned system with trust boundaries.
- Enumerate the attack surface: every interface, service, and data store crossing a boundary.
- Define threat actors and their capabilities.
- Apply STRIDE to each DFD element; record only threats that are relevant to the intended use or foreseeable misuse.
- Derive security requirements; hand risks with L×I scoring back to SEC-RA-S300.
Tooling: DFD maintained as threat-model/s300.drawio in the project repo; this document is the reviewed export.
2. System overview and trust boundaries
Elements: [S300 device] — (TB1: radio link) — [Gateway G50] — (TB2: plant network) — [Customer backend]. Local boundaries on the device: (TB3) physical enclosure incl. debug interfaces; (TB4) flash storage vs. application.
3. Attack surface inventory
| # | Interface / element | Exposed at | Planned default state |
|---|---|---|---|
| AS-1 | IEEE 802.15.4 radio, join + telemetry service | TB1 | On (required), authenticated join only |
| AS-2 | SWD debug port | TB3 | Fused/locked in production |
| AS-3 | UART service connector | TB3 | No shell; signed-command maintenance protocol only |
| AS-4 | Firmware update endpoint (via radio) | TB1 | On; signature-verified images only |
| AS-5 | External SPI flash (keys, buffer) | TB4 | Encrypted at rest |
| AS-6 | NFC commissioning tag (read-only device ID) | TB3 | Read-only, no secrets stored |
4. Threat actors
| Actor | Capability | Motivation |
|---|---|---|
| TA-1 Opportunistic on-site person | Physical access, consumer tools | Curiosity, theft |
| TA-2 Skilled attacker with stolen unit | Lab equipment, firmware analysis | Extract mesh keys, clone devices |
| TA-3 Remote attacker on plant network | Network access beyond G50 | Pivot into OT environment |
| TA-4 Malicious insider at customer | Legitimate commissioning rights | Manipulate measurements |
5. STRIDE findings (relevant subset)
| ID | Element | STRIDE | Threat | Actor | → Requirement / risk |
|---|---|---|---|---|---|
| T-01 | AS-1 join | Spoofing | Rogue node joins mesh with cloned identity | TA-2 | SR-S300-05 (authenticated join, per-device keys) / R-03 |
| T-02 | AS-1 telemetry | Tampering | Frame manipulation in transit | TA-3 | SR-S300-06 (AEAD on link layer) / R-05 |
| T-03 | AS-4 | Tampering/EoP | Malicious firmware accepted | TA-2/3 | SR-S300-04 (signed updates, rollback protection) / R-02 |
| T-04 | AS-2/AS-3 | Info disclosure | Key/firmware extraction via debug | TA-2 | SR-S300-07 (fuse lock, no UART shell) / R-04 |
| T-05 | AS-5 | Info disclosure | Flash desoldered and read | TA-2 | SR-S300-01 (data-at-rest encryption, key in MCU vault) / R-01 |
| T-06 | AS-1 | DoS | Radio jamming | TA-1/3 | Out of device scope; stale-data detection at gateway (D-2026-12) / R-06 |
| T-07 | AS-6 | Tampering | Swapped NFC tag misdirects commissioning | TA-4 | SR-S300-08 (tag content cryptographically bound to device ID) |
| T-08 | Update+join combined | Repudiation | No trace of who re-paired a node | TA-4 | SR-S300-09 (commissioning events logged at gateway) |
6. Derived security requirements (handover)
SR-S300-01, -04, -05, -06, -07, -08, -09 enter the Security Requirements Sheet as mandatory before architecture freeze. T-05/T-01 jointly confirm the hardware constraint assessed in ENG-REC-032.
7. Maintenance rule
This threat model is re-run (delta workshop) whenever an interface, protocol, or trust boundary changes, and at least once per major release. All revisions are retained.