# Threats list for specific components

**URL:** <https://threatmodelingconnect.discourse.group/t/threats-list-for-specific-components/787>\
**Category:** General\
**Created:** [February 11, 2025, 4:22pm UTC](https://threatmodelingconnect.discourse.group/t/threats-list-for-specific-components/787 "2025-02-11T16:22:13Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![vyasar](https://avatars.discourse-cdn.com/v4/letter/v/c0e974/32.png) [@vyasar](https://threatmodelingconnect.discourse.group/u/vyasar)\
**Post date:** [February 11, 2025, 4:22pm UTC](https://threatmodelingconnect.discourse.group/t/threats-list-for-specific-components/787/1 "2025-02-11T16:22:13Z")

</div>

Hello All,

I am new to Threat modelling, looking your support to learn and complete my new assignment. I came across some threat modelling tools like OWASP threat dragon to design some models but need some more practices. Just curious to understand , how we can gather the list of threats for specific components like mongo db or application server.

---

<div class="post-metadata">

**Author:** ![ClaireAA](https://sea2.discourse-cdn.com/flex002/user_avatar/threatmodelingconnect.discourse.group/claireaa/32/93_2.png) [@ClaireAA](https://threatmodelingconnect.discourse.group/u/ClaireAA)\
**Post date:** [February 11, 2025, 4:52pm UTC](https://threatmodelingconnect.discourse.group/t/threats-list-for-specific-components/787/2 "2025-02-11T16:52:51Z")

</div>

Hi there, that is great you already found Threat Dragon! I wonder if this blog might help you discover some other free tools - [11 Recommended Threat Modeling Tools](https://www.iriusrisk.com/resources-blog/recommended-threat-modeling-tools)

In terms of gathering the threats - this may help you from OWASP: [Threat Modeling Process | OWASP Foundation](https://owasp.org/www-community/Threat_Modeling_Process) - as it establishes key steps to take and introduces you to the popular STRIDE methodology which can also benefit your knowledge building.

Hope this helps, happy threat modeling!  
Claire

---

<div class="post-metadata">

**Author:** ![Dave](https://sea2.discourse-cdn.com/flex002/user_avatar/threatmodelingconnect.discourse.group/dave/32/138_2.png) [@Dave](https://threatmodelingconnect.discourse.group/u/Dave)\
**Post date:** [February 23, 2025, 9:52am UTC](https://threatmodelingconnect.discourse.group/t/threats-list-for-specific-components/787/3 "2025-02-23T09:52:31Z")

</div>

Another good OWASP resources to understand potential threats is to look through [https://cheatsheetseries.owasp.org/](https://cheatsheetseries.owasp.org/). There may not be one for a specific component like Mongo DB, but there is usually one for the generic component i.e. [Database Security Cheatsheet](https://cheatsheetseries.owasp.org/cheatsheets/Database_Security_Cheat_Sheet.html).

For very specific threats against a particular component e.g. Mongo DB, you could either search the component website for security guidance or for details about past security issues, or search for [CVE](https://www.cve.org/)s relating to the component.