Start a threat model
threat_model_starterCreates a tailored threat-modeling starting point from a system description, returning prioritized risk matrices, trust-boundary guidance, and missing input details to review with security teams.
Instructions
対象システムの説明から公開範囲・扱うデータの機微性・利用者規模・主体の種類を読み取り、その状況に合わせた脅威モデリングの出発点を作る。読み取り結果と根拠、状況に応じた信頼境界の引き方、資産 × 6 観点(なりすまし/改ざん/否認/情報漏えい/サービス妨害/権限昇格)の優先度入りの表(空欄では返さない)、まず埋めるべき 3 セル、観点ごとにこの状況で実際に起きやすいこと、入力に足りない情報を返す。社外公開の大規模ポータルと閉域網の IoT 基盤では中身が変わる。出力は草案であり、セキュリティ担当との対話で確定させる前提。 / Read exposure, data sensitivity, user scale, and subject types out of a system description, then build a threat-modelling starting point fitted to that situation. Returns what was read and on what evidence, situation-specific trust-boundary rules, an asset-by-lens matrix over the six lenses (spoofing, tampering, repudiation, information disclosure, denial of service, elevation of privilege) that comes back already prioritized rather than blank, the three cells to fill first, what actually tends to go wrong here under each lens, and what the input did not say. A large public portal and an isolated IoT platform get materially different answers. The output is a draft to be settled in conversation with a security owner.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| lang | No | 出力言語 / Output language | both |
| actors | No | 登場する主体・攻撃者。省略すると一般的な候補を出す / Subjects and adversaries; omitted, a generic candidate set is used | |
| assets | No | 守る対象。省略すると一般的な候補を出す / What is being protected; omitted, a generic candidate set is used | |
| system | No | 対象システムの説明。公開範囲・利用者規模・扱うデータ・外部連携が書かれているほど助言が具体的になる。省略すると書き方の案内を返す / A description of the target system. The more it says about exposure, user scale, the data held, and external connections, the more specific the advice. Omit it to get guidance on what to write — 最大 20,000 文字 at most 20,000 characters |