Threat Modeling a Linux Host

Why this matters

A Linux host's threat surface decomposes into: kernel (LPE), services (network-exposed daemons), users (credentials, shells), filesystem (DAC bypasses, SUID), and the supply chain (packages, container images). Threat-modelling a host means walking each surface and asking 'what's the worst that fits an adversary's budget?'.

Demo

Concrete: an internal DB host's threat surface is dominated by the DB daemon (CVEs), SSH (credentials), the data volume (encrypted at rest?), and SUID binaries (sudoers, polkit). Five threats, five controls; everything else is variance on those.

Try it yourself

1. Pick a host. Walk through STRIDE: Spoofing (auth), Tampering (filesystem integrity), Repudiation (audit), Info disclosure (file perms), DoS (resource limits), Elevation (sudoers + SUID).
2. For each, name one or two controls in place and one residual risk.
3. Build a 1-page threat model. Use it in the next on-call hand-off.

References

• OWASP — Threat Modeling Cheat Sheet
• CIS Benchmarks — Linux