While it does not matter which threat catalog we use, the fact that we do use different threats for each layer is the core message of this article. Using higher-order threats (‘meta-attacks’) on the architectural layer is more efficient and effective than using very concrete and technology-specific threats (‘standard attacks’).

For example, arguing about SQL injection (a standard attack) with an enterprise architect when it is not even known yet that the database technology will actually be susceptible to such an injection makes little sense. Talking about the more generic ‘command injection’ threat (a meta-attack) at the architectural layer is more helpful. The SQL injection threat does become relevant when discussing actual solutions.

As a second example, discussing password brute forcing, phishing, password spraying, etc. (standard attacks) on the architectural layer is much too narrow and leads to useless conversations because the actual technology is not yet known. Rather, using the broader meta-attack of ‘identity spoofing’ at the architectural layer is much more useful: it makes the architect realize that this threat should be covered using the correct authentication and authorization building blocks, without diving into a discussion on threats that are not relevant at this point yet.

This reasoning results in architectural threats on the architectural layer and solution threats on the solution layer. Of course, the threats on both layers are interlinked (the solution-layer threat ‘realizes’ the architecture-layer threat) as shown on the following model: