Lion Cipher Lab

Model privacy threats with LINDDUN (privacy threat modeling)

• GRC / Compliance
• Advanced
• ~90 min
• Free · no account required

Why it matters

Most teams find privacy problems the expensive way: after launch, in a regulator's letter or a breach headline. The cheap way is to find them on a whiteboard before you build — but only if you look SYSTEMATICALLY, because privacy harms hide in exactly the places a security review waves through. STRIDE, the standard security threat-modeling method, elicits spoofing, tampering, and information-disclosure threats; it is blind to harms that occur when the system is working perfectly and securely: a service that can LINK a user's separate visits into a profile, that can IDENTIFY an…

What you'll learn

• why privacy threat modeling is different from security threat modeling (LINDDUN vs STRIDE)
• the seven LINDDUN threat categories and the privacy property each one negates
• drawing a Data Flow Diagram (DFD): external entities, processes, data stores, data flows, and trust boundaries
• mapping LINDDUN categories to DFD element types so no threat is forgotten
• eliciting concrete privacy threats per element using the LINDDUN threat trees / catalog
• prioritizing threats by likelihood x impact so the analysis does not explode
• selecting privacy controls / PETs (data minimization, pseudonymization, anonymization, consent & notice, differential privacy, encryption) and recording residual risk
• producing a prioritized privacy threat register that FEEDS a DPIA / GDPR Art. 35 and a Privacy-by-Design program
• using LINDDUN GO (the lightweight card deck) as a fast on-ramp
• the judgment of when LINDDUN helps, its limits, and how to tie it to a control framework

Steps in this lab

1. The gap LINDDUN fills: privacy harm is not the same as insecurity
2. The seven LINDDUN categories — learn them cold before you walk
3. Pick a system and draw its Data Flow Diagram (DFD)
4. Map the categories to DFD element types (the coverage grid)
5. Elicit concrete threats per element with the threat trees
6. Prioritize: without this the analysis explodes
7. Select mitigations: privacy controls and PETs, then residual risk
8. Speed run: LINDDUN GO when you don't have hours
9. How this feeds a DPIA, GDPR Art. 35, and Privacy-by-Design
10. The judgment: when LINDDUN wins, its limits, and doing it better

Open the full interactive lab →