A practical methodology for security design review and threat modeling — built for every stakeholder in an SDLC, not just security engineers.
STRIDE requires data flow diagrams. PASTA requires attack simulation. All start with threats — which means reviews never get done unless a specialist runs them. A-SDF asks a different first question.
A-SDF does not require a security background to run. If you can describe what your system does, you can run a review.
A-SDF is designed for real SDLC cadences — not once-a-year compliance exercises.
The same methodology regardless of technology stack. The asset domains adapt to the solution — the method never changes.
Every abuse case — across Web Apps, SaaS, Cloud, and GenAI — derives from a single pattern.
Every system can be decomposed into these domains. Identifying assets before threats is what makes A-SDF different from every existing methodology. Asset names adapt to solution context — a Component in a web app becomes "Payment workflow" or "Resume upload interface".
* Every review starts with User. Component replaces the generic System domain for application-layer reviews. Infra is a separate review scope.
The output of every A-SDF review is a four-column table — Asset, Abuse Case, Preventive Control, Detective Control. One row per abuse case. No risk scores. No gap columns.
Sample output — Employee SaaS Portal (personal profile, resume upload, salary slip download)
| Asset | Abuse Case | Preventive Control | Detective Control |
|---|---|---|---|
Component Resume upload interface |
Attacker uploads malware disguised as a PDF resume, compromising the document processing pipeline. | Validate file type server-side. Scan on upload with AV. Store files outside webroot. Reject unsupported formats silently. | Alert on AV scan failures, unexpected file extensions, or upload volume spikes per user session. |
Component Business profile form |
Employee manipulates their own designation or cost centre via direct API call to gain elevated privileges in downstream systems. | Business fields read-only to employees — HR role only. Enforce server-side. Never trust client-submitted role or department values. | Alert on any API call attempting to modify designation, department, or cost centre fields outside HR role session. |
Actions Salary slip download |
Authenticated employee downloads a colleague's salary slip by manipulating the document ID parameter in the download request. | Enforce server-side ownership check on every download request — authenticated user ID must match the salary slip owner ID. Reject and log mismatches. | Alert on any salary slip access where requesting user ID ≠ document owner ID. Flag off-hours bulk download attempts. |
Data Personal profile — PII |
Insider or compromised HR account exports bulk employee personal data without a legitimate business reason. | Enforce least-privilege on HR data access. No bulk export without manager approval workflow. Mask sensitive fields in UI by default. | Alert on bulk export exceeding 50 records. Log all PII field access with identity, timestamp, and action type. Weekly access review. |
* A full review covers all asset domains — typically 12–18 rows. Downloadable as PDF or CSV.
A-SDF is an independent methodology. It does not extend or layer on existing frameworks.
| Dimension | A-SDF | STRIDE | OWASP TM |
|---|---|---|---|
| Starting point | Assets the system owns | Data flow diagrams | Application attack surfaces |
| First question | "What does this system own?" | "Where are our trust boundaries?" | "What are our attack surfaces?" |
| Controls in output | Yes — preventive and detective per abuse case | No — threat list only | Partial — via external cheat sheets |
| Diagrams required | None | DFD mandatory | Architecture diagram required |
| Who can run it | Any SDLC stakeholder | Security engineers only | Security engineers only |
| GenAI support | Native — Intelligence asset domain | Not designed for LLM scope | Limited — separate LLM Top 10 track |
| Asset naming | Context-specific — named after what it actually is | Generic component types | Generic attack surface labels |
4 threat models per month. No credit card required. Output in minutes.
Start at threatmodeling.in →