Practical threat modelling exercises for researchers
Published: August 20, 2025
Threat modelling is the practice of asking: How could someone — whether maliciously or by accident — undermine or negatively affect my research project? It helps reveal areas that require additional protection.
This article introduces three lightweight modelling approaches — ones that are fairly simple and quick to implement. These approaches — STRIDE, DREAD and attack trees — are ones that research teams can use in a single brainstorming session and return to as a shared security compass.
Why threat modelling matters in research
By practicing good threat modelling, you can close security gaps, proactively demonstrate compliance and trust — and help keep your research on schedule and on budget.
-
Protect participants, data and intellectual property
Spotting how confidential and sensitive data or unpublished manuscripts could leak or be altered allows you to close those gaps before they impact your work.
-
Demonstrate proactive security and compliance
By linking potential threats to mitigation strategies, you show funders, data providers and collaborators that your team takes cyber security seriously — reinforcing trust and potentially improving grant competitiveness.
-
Avoid costly setbacks
Addressing risks early helps prevent breach-related delays, audits or cleanup — keeping your research on schedule and on budget.
STRIDE: A high-level security sweep
Developed by Microsoft in the 1990s, STRIDE is a six-part mnemonic that helps identify potential threats to your research systems and workflows.
| Threat domain | What it means | Example |
|---|---|---|
| Spoofing identity | Pretending to be someone or something else | A malicious actor reuses stolen secure shell keys to access research systems |
| Tampering with data | Secretly altering data or code | Edits to analysis scripts affect research outcomes |
| Repudiation | Denying an action or erasing the record of it | A user deletes logs to hide unauthorized file downloads |
| Information disclosure | Unintentionally exposing sensitive information | A public cloud folder contains human subject data |
| Denial of service | Overloading a system until it fails | A lab’s portal crashes due to fake job submissions |
| Elevation of privilege | Gaining access beyond what is allowed | Misconfigured settings let a user change server configurations |
STRIDE: A high-level security sweep
Developed by Microsoft in the 1990s, STRIDE is a six-part mnemonic that helps identify potential threats to your research systems and workflows.
| Threat domain | What it means | Example |
|---|---|---|
| Spoofing identity | Pretending to be someone or something else | A malicious actor reuses stolen secure shell keys to access research systems |
| Tampering with data | Secretly altering data or code | Edits to analysis scripts affect research outcomes |
| Repudiation | Denying an action or erasing the record of it | A user deletes logs to hide unauthorized file downloads |
| Information disclosure | Unintentionally exposing sensitive information | A public cloud folder contains human subject data |
| Denial of service | Overloading a system until it fails | A lab’s portal crashes due to fake job submissions |
| Elevation of privilege | Gaining access beyond what is allowed | Misconfigured settings let a user change server configurations |
Attack trees: Visualizing how attacks unfold
Attack trees break down an attacker's goal into sub-goals and concrete steps. This helps clarify how top threats could be executed and where defences are most needed.
Sample one-hour brainstorming session
| Time | Activity | Outcome |
|---|---|---|
| 0–20 min | STRIDE sweep | Top threats identified using six security questions |
| 20–40 min | DREAD scoring | Prioritized list of threats to address |
| 40–60 min | Attack tree | Visual map of how key threats might be executed |
From insight to action
Threat modelling isn't one-and-done — it's a continuous process of improving resilience. The good news? The hardest part (identifying risks) is already done. Here's what to do next:
Need support?
Teams can run these exercises independently, but help is available. The Research Information Security Program offers consulting, training and facilitated workshops. Contact your unit IT staff or divisional security lead for support.
