Webhook ingestion threat model

// Review forged, replayed, out-of-order and flooded events in webhook ingestion, and who owns each control; ordinal scores and coverage are illustrative assumptions.
// Synthetic worked example: all entities, schedules and measurements are illustrative.
// Every string below is EXAMPLE text from a fictional model: replace it.
// Replace assumptions and inputs before applying this model to actual work.

threat_model assessment {
  title: "Illustrative Webhook ingestion threat model"
  framework: "STRIDE"
  scope: "Design review; scores are illustrative ordinal judgements"
}

asset asset_0 {
  name: "Inbound event stream"
  value: "Protect confidentiality, integrity and availability"
  classification: "restricted"
}

asset asset_1 {
  name: "Processed operation ledger"
  value: "Protect confidentiality, integrity and availability"
  classification: "restricted"
}

threat r1 {
  title: "R1 · Forged event"
  // Scenario: Sender identity is not verified
  asset: asset_0
  category: "spoofing"
  likelihood: 3
  impact: 4
}

control control_0 {
  title: "Verify provider signatures on raw payload bytes"
  mitigates: [r1]
  type: "preventive"
  coverage: 0.6
  owner: "System owner; validate residual risk"
}

threat r2 {
  title: "R2 · Replay of old event"
  // Scenario: A valid event is submitted repeatedly
  asset: asset_1
  category: "tampering"
  likelihood: 2
  impact: 5
}

control control_1 {
  title: "Deduplicate by immutable event identifier"
  mitigates: [r2]
  type: "preventive"
  coverage: 0.6
  owner: "System owner; validate residual risk"
}

threat r3 {
  title: "R3 · Out-of-order update"
  // Scenario: An older event overwrites newer state
  asset: asset_0
  category: "tampering"
  likelihood: 4
  impact: 3
}

control control_2 {
  title: "Require sequence or version checks"
  mitigates: [r3]
  type: "preventive"
  coverage: 0.6
  owner: "System owner; validate residual risk"
}

threat r4 {
  title: "R4 · Event flood"
  // Scenario: Unbounded event volume fills the queue
  asset: asset_1
  category: "dos"
  likelihood: 3
  impact: 2
}

control control_3 {
  title: "Rate-limit and isolate bounded queues"
  mitigates: [r4]
  type: "preventive"
  coverage: 0.6
  owner: "System owner; validate residual risk"
}

view risks: risk_matrix