Interesting!
Seems like there’s different perspectives on what a threat library is.
Here is mine: Somebody threat modeled a more abstract / generic version of a building block that may be part of your system. We are invited to ask ourselves if that applies to our system: Similar scope? Similar threats? Want to follow suggested mitigations?
Some examples:
- Generic threat model of account takeover
- OWASP Cumulus threat modeled the clouds
and invites us to think about those threats
- Awesome industry focused threat libraries by Versprite / Fork by TonyUV and the PASTA guys has domain specific inspiration
- OWASP Application Security Verification Standard (ASVS) can be reframed as a threat model of a generic application that cuts on threats
(
) Threat Modeling of Threat Modeling #meta is a generic threat model of things that may go wrong with threat modeling process - we can go more specific, build our own vendor-specific thing or see if those apply to us
- …
We can import stuff from everywhere!
If we build the same things again and again, we should create and reuse a (generic) threat model. In my opinion threat library is not totally different from threat modeling in general.