Bachelor and Master Theses

Background

System descriptions may identify operators, administrators, or other users without explaining their permissions, responsibilities, or conditions of access. These details can affect whether a proposed security threat is justified. This thesis investigates how explicit information about human roles changes AI-assisted STRIDE threat modeling.

Research questions

RQ1: How does adding relevant human-role information to a system description affect the generated threats?

RQ2: Which changes in the output appear supported by the added context, and which remain uncertain or unsupported?

Methodology

1. Review relevant work on STRIDE, human actors, and AI-assisted threat modeling.

2. Select a manageable set of descriptions containing human actors and prepare original and carefully enriched versions without changing the system function.

3. Apply a consistent AI-assisted analysis to both versions and develop a way to compare the resulting threats.

4. Examine selected differences against the information in each description and discuss limitations. The exact role attributes, cases, and comparison criteria will be justified during the thesis.

Expected outcomes

-A documented set of paired system descriptions with the human-role information added to each, where sharing is permitted.

-A comparison showing which threat statements or STRIDE categories changed and whether the changes are supported by the descriptions.

-A thesis report with the method, evidence, limitations, and practical guidance on describing human roles for threat modeling.

Basic knowledge of cybersecurity and system descriptions; familiarity with STRIDE or access control is helpful.