TRACE: A Threat Modelling Methodology for Distributed, Cloud-First, and Decentralized Organisations
This paper introduces TRACE, a novel threat modelling methodology designed for distributed, cloud-first, and decentralized organizations that addresses the limitations of traditional frameworks by treating threat actors, roles, assets, and trust edges as first-class objects across protocols, systems, and organizational layers to better mitigate risks like authorized-but-malicious actors and control-plane compromises.
Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer
Imagine you are trying to secure a massive, high-stakes bank.
For decades, security experts used a specific playbook (like STRIDE or Attack Trees) to protect these banks. This playbook was built on three simple assumptions:
- The Wall: There is a clear fence (a perimeter) separating the safe inside from the dangerous outside.
- The Owner: One single company owns the building, the money, the guards, and the keys.
- The Badge: If someone has a security badge and walks through the door, they are safe. We only worry about people without badges.
The Problem:
The paper argues that modern organizations (especially those using the cloud, AI, and decentralized teams) have completely broken these rules.
- No Wall: The bank isn't in one building anymore; its money and data are scattered across dozens of different cloud services and apps that the bank doesn't even own.
- Many Owners: The "keys" to the vault are split among founders, contractors, automated robots, and committees in different countries.
- Badges Lie: The biggest danger isn't a thief breaking in; it's the trusted guard who decides to steal, or two guards who secretly agree to open the vault together.
Because the old playbooks don't account for "trusted people doing bad things" or "complex webs of different companies," they miss the most dangerous threats.
The Solution: TRACE
The author, Stefan Beyer, introduces a new method called TRACE. Think of TRACE not as a new lock, but as a new way of drawing the map of the bank.
Instead of just looking at "doors and walls," TRACE forces you to map out five specific things as if they were real, physical objects:
- The Players (Threat Actors): Not just "hackers," but also the specific vendors, contractors, and automated bots who have power.
- The Roles: Who actually holds the keys? (e.g., the person who signs the check, the person who controls the server).
- The Treasure (Assets): What are we actually protecting? (Money, data, reputation).
- The Rules (Invariants): This is the most important new part. These are the "Golden Rules" that must never break.
- Example: "No single person can move more than 10% of the funds."
- Example: "Two people must agree before a software update is released."
- Why it matters: If you don't name the rule, you can't measure if it's broken.
- The Bridges (Edges): These are the specific points where trust crosses from one place to another (e.g., from a vendor's computer to your cloud server).
How It Works (The Three Layers)
TRACE looks at the problem from three different angles, like a 3D scanner:
- The Protocol Layer: How do the rules and code work? (e.g., How does the voting system work?)
- The System Layer: How do the computers and cloud services connect? (e.g., Where does the data flow?)
- The Organization Layer: How do the humans and teams actually behave? (e.g., Who approves the emergency fixes? What happens if a key person gets sick?)
The "Human-AI" Team
The paper also suggests a new way to work with Artificial Intelligence (AI).
- The AI's Job: Imagine the AI is a super-fast intern. It can read thousands of documents, find all the names of people, list all the servers, and suggest a list of "things that could go wrong."
- The Human's Job: The human is the Senior Manager. The intern (AI) might suggest a threat that sounds scary but is impossible in real life. The human must look at the AI's list and say, "Yes, that's a real risk," or "No, that's just a guess."
- The Rule: The AI can never make the final decision. Every threat the AI finds must be tied back to a real document (evidence). If the AI can't prove it, it gets thrown out.
Why This Matters
The paper claims that in the modern world, the biggest disasters happen because:
- A trusted person gets tricked into signing a bad deal.
- Two "independent" vendors secretly collude.
- A software update pipeline gets hacked, and the "trusted" system ships a virus.
Old methods miss these because they assume the "bad guy" is always outside the fence. TRACE assumes the fence is gone, the keys are scattered, and the real danger is the person holding the keys. It forces you to name the "Golden Rules" (Invariants) and check if they are actually being followed, even when things get complicated.
In short: TRACE is a new map for a world without walls, designed to catch the threats that happen when the "good guys" are the ones who cause the problem.
Drowning in papers in your field?
Get daily digests of the most novel papers matching your research keywords — with technical summaries, in your language.