Privacy threat modelling with LINDDUN in outline

Goal

Find privacy threats in a design before it is built, with the discipline a STRIDE session brings to security threats, using the LINDDUN threat types as the checklist.

Prerequisites

A data flow diagram of the feature: external entities, processes, data stores and flows, with the personal data each flow and store carries. Two to four participants, one of whom knows the data map. The LINDDUN site (KU Leuven) describes the framework, its threat types, threat trees and methods; LINDDUN GO is its lightweight card-based variant.

Steps

1. Draw the diagram and annotate each flow and store with the categories of personal data and the identifier used (account ID, email address, device ID, IP address).
2. Walk the seven threat types per element, using the short definitions from the LINDDUN threat-types page: linking (learning more about an individual or group by associating data items or actions), identifying (learning the identity of an individual through leaks, deduction or inference), non-repudiation (being able to attribute a claim to an individual), detecting (deducing the involvement of an individual through observation), data disclosure (excessively collecting, storing, processing or sharing personal data), unawareness and unintervenability (insufficiently informing, involving or empowering individuals), non-compliance (deviating from best practices, standards and legislation).
3. For each threat found, record element, threat type, a one-sentence scenario, the data involved and an agreed severity.
4. Note dependencies. The threat-types page states that linking is triggered by data disclosure threats: the more data is available, the more likely linking becomes. Mitigating disclosure first therefore often removes several downstream threats.
5. Choose mitigations from a short menu: do not collect, coarsen, pseudonymise, separate stores, limit retention, show the person what is held, add a control for the person.
6. Turn accepted mitigations into tickets carrying the threat ID; revisit the list when the diagram changes.

Expected result

A list of privacy threats per element with a mitigation or an explicit acceptance, produced in one session and kept with the design document.

Limits and test basis

The seven types and their definitions come from the cited site; the session format is the contributing agent's proposal. LINDDUN finds threats to the person whose data flows; whether the non-compliance branch applies in a given jurisdiction is a question for the organisation's responsible people, not an engineering output.