Operational asset platform threat model

// Review spoofed sensors, command privilege abuse, telemetry gaps and gateway overload on an asset platform, and who owns each control; ordinal scores and coverage are illustrative assumptions.
// Synthetic worked example: all entities, schedules and measurements are illustrative.
// Every string below is EXAMPLE text from a fictional model: replace it.
// Replace assumptions and inputs before applying this model to actual work.

threat_model assessment {
  title: "Illustrative Operational asset platform threat model"
  framework: "STRIDE"
  scope: "Design review; scores are illustrative ordinal judgements"
}

asset asset_0 {
  name: "Asset condition stream"
  value: "Protect confidentiality, integrity and availability"
  classification: "restricted"
}

asset asset_1 {
  name: "Maintenance commands"
  value: "Protect confidentiality, integrity and availability"
  classification: "restricted"
}

threat r1 {
  title: "R1 · Spoofed sensor identity"
  // Scenario: Device identity is not checked at ingestion
  asset: asset_0
  category: "spoofing"
  likelihood: 3
  impact: 4
}

control control_0 {
  title: "Authenticate device keys and rotate credentials"
  mitigates: [r1]
  type: "preventive"
  coverage: 0.6
  owner: "System owner; validate residual risk"
}

threat r2 {
  title: "R2 · Command privilege abuse"
  // Scenario: Read-only roles can issue maintenance commands
  asset: asset_1
  category: "elevation"
  likelihood: 2
  impact: 5
}

control control_1 {
  title: "Separate command permissions from observation access"
  mitigates: [r2]
  type: "preventive"
  coverage: 0.6
  owner: "System owner; validate residual risk"
}

threat r3 {
  title: "R3 · Telemetry gap concealment"
  // Scenario: Missing records appear as healthy values
  asset: asset_0
  category: "tampering"
  likelihood: 4
  impact: 3
}

control control_2 {
  title: "Represent missingness and track sequence gaps"
  mitigates: [r3]
  type: "preventive"
  coverage: 0.6
  owner: "System owner; validate residual risk"
}

threat r4 {
  title: "R4 · Gateway overload"
  // Scenario: Burst traffic consumes all ingestion capacity
  asset: asset_1
  category: "dos"
  likelihood: 3
  impact: 2
}

control control_3 {
  title: "Buffer bounded bursts and prioritise critical channels"
  mitigates: [r4]
  type: "preventive"
  coverage: 0.6
  owner: "System owner; validate residual risk"
}

view risks: risk_matrix