Threat modeling Linux hosts

Why this matters

A Linux host's threat surface decomposes into: kernel (LPE), services (network-exposed daemons), users (credentials, shells), filesystem (DAC bypasses, SUID), and the supply chain (packages, container images). Threat-modelling a host means walking each surface and asking 'what's the worst that fits an adversary's budget?'.

Demo

Concrete: an internal DB host's threat surface is dominated by the DB daemon (CVEs), SSH (credentials), the data volume (encrypted at rest?), and SUID binaries (sudoers, polkit). Five threats, five controls; everything else is variance on those.

Try it yourself

1. Pick a host. Walk through STRIDE: Spoofing (auth), Tampering (filesystem integrity), Repudiation (audit), Info disclosure (file perms), DoS (resource limits), Elevation (sudoers + SUID).
2. For each, name one or two controls in place and one residual risk.
3. Build a 1-page threat model. Use it in the next on-call hand-off.

Prompt your AI

Use these three in order. Each builds on the one before.

1. Basics & terminology

In one paragraph, list the five threat surfaces of a Linux host.

2. Why it works (the mechanism)

Walk me through threat-modelling a database host step by step.

3. Advanced — application & what's next

Design threat-modelling automation: produce a fresh model from a host's actual config.

References

• OWASP — Threat Modeling Cheat Sheet
• CIS Benchmarks — Linux