Prevent
Reduce likelihood through authentication, authorization, trusted distribution, input validation, policy and explicit boundaries.
MOBILE-ID SIGN · TRUST & ASSURANCE
Threat Model & Control Mapping
Map attack scenarios to boundaries, controls, recovery actions and retained evidence.
ON THIS PAGE
THREAT MODEL
Threat → Control → Evidence
This is a defensive architecture threat model and does not contain exploitation instructions. A control moves from CONCEPTUAL/REFERENCE to VERIFIED only with design/implementation evidence.
If the table is wider than its frame, scroll horizontally to see all columns; use arrow keys when the table region has focus.
| Threat | Control direction | Status |
|---|---|---|
| Document substitution | Hash/reference binding; transaction summary; validation | Conceptual |
| Replay | Nonce/timestamp/idempotency/replay window according to contract | Conceptual |
| Session hijacking | Strong session/authentication controls; re-authorization for sensitive action | Conceptual |
| Fake Agent / local app | Package authenticity, trusted distribution, application boundary | Conceptual |
| Webhook spoofing | Signed/authenticated webhook plus timestamp verification | Reference |
| Provider outage | Explicit states, retry/reconciliation, operator visibility | Reference |
| Expired/revoked certificate | Certificate status and validation before acceptance | Conceptual |
| Evidence tampering | Immutable/auditable event references according to deployed evidence store | Conceptual |
THREAT → CONTROL
Threats are evaluated against assets and boundaries
A threat list is useful only when it shows prevention, detection, response and evidence.
If the table is wider than its frame, scroll horizontally to see all columns; use arrow keys when the table region has focus.
| Threat | Asset / boundary | Prevent | Detect | Respond |
|---|---|---|---|---|
| Document substitution | Document/hash/context | Bind reviewed document/version to signing context | Hash/version check; validation | Stop transaction; preserve evidence |
| Replay | Authorization/event | Nonce/timestamp/idempotency where contract supports | Duplicate/replay detection | Reject/reconcile |
| Fake Agent | Desktop user/application | Trusted distribution + application authenticity controls where supported | Version/source validation | Block; reinstall from trusted source |
| Credential leakage | API / admin credential | Server-side secret handling, least privilege, rotation | Auth anomaly / access logs | Revoke / rotate / investigate |
| Webhook spoofing | Callback endpoint | Signature/timestamp verification where defined | Invalid-signature event | Reject; do not update business state |
| Provider outage | Signing route | Timeout/retry policy and approved alternate route | Provider health / transaction state | Retry or manual support; no silent downgrade |
| Certificate status | Signature validation | Check certificate/status according to applicable validation policy | Validation result | Do not accept invalid/revoked result |
| Evidence tampering | Audit/evidence package | Integrity protection and controlled access | Hash/audit mismatch | Preserve original; investigate |
Defensive model
The threat model focuses on defensive risk/control relationships and omits exploit instructions. Controls marked conceptual are not production-security claims.
ASSESSMENT DETAIL
From threat model to operational control
A threat becomes actionable only when it is linked to an asset, boundary and evidence. Document substitution, for example, requires evidence of the version/hash presented for approval; replay requires transaction identity, freshness and duplicate handling; a fake Agent requires trusted distribution/application authenticity; webhook spoofing requires message authenticity and replay checks; provider outage requires timeout, retry and reconciliation rather than a generic error.
Detect
Record enough context to distinguish business failure, security anomaly and duplicate/replayed activity.
Respond
Move the transaction into a supportable/reconcilable state without hiding failure or creating an out-of-policy replacement signature.
Prove
Retain audit/evidence showing actor, request, document reference, authorization, provider result and recovery action.
Controls without production artefacts remain CONCEPTUAL. The threat model omits exploit steps and does not imply penetration-test coverage without a corresponding report.