# CALISDO: Threat Modeling for Distributed Designs

DevFeed: [CALISDO: Threat Modeling for Distributed Designs](<https://devfeed.tech/articles/calisdo-threat-modeling-for-distributed-designs-12476.md>)

Original publisher: [Read original article](<http://brooker.co.za/blog/2015/06/20/calisto.html>)

Author: Marc Brooker

Published: 2015-06-20T00:00:00Z

Content type: article

Language: en

Sources: [Marc Brooker's Blog](<https://devfeed.tech/sources/marc-brooker-s-blog.md>), [Marc Brooker's Blog](<https://devfeed.tech/sources/marc-brooker-s-blog-2.md>)

Topics: [distributed-systems](<https://devfeed.tech/topics/distributed-systems.md>), [Architecture & Design](<https://devfeed.tech/topics/architecture-design.md>), [Availability](<https://devfeed.tech/topics/availability.md>), [Latency](<https://devfeed.tech/topics/latency.md>), [Scalability](<https://devfeed.tech/topics/scalability.md>), [Security](<https://devfeed.tech/topics/security.md>)

Tags: [availability](<https://devfeed.tech/tags/availability.md>), [design](<https://devfeed.tech/tags/design.md>), [distributed-systems](<https://devfeed.tech/tags/distributed-systems.md>), [latency](<https://devfeed.tech/tags/latency.md>), [scalability](<https://devfeed.tech/tags/scalability.md>), [security](<https://devfeed.tech/tags/security.md>), [systems](<https://devfeed.tech/tags/systems.md>)

## AI overview

This article introduces CALISDO, a mnemonic-based threat model for analyzing distributed systems designs. It structures evaluation around Consistency, Availability, Latency, Integrity, Scalability, Durability, and Operational Costs, with questions focused on client-visible behavior, data integrity, failure conditions, performance, and operational trade-offs.

## Source excerpt

CALISDO: Threat Modeling for Distributed Designs Some steps towards a mnemonic threat model for distributed systems. Threat modeling from the security field, and business impact analysis from the continuity management field, are powerful and influential ways of structured thinking about particular kinds of problems. The power of threat modeling comes from its structure. By imposing a structure on the thought process, we reduce the number of things that we miss, and make the information more analyzable and accessible. Two popular classic tools for structuring threat modeling are STRIDE and DREAD, both originally from Microsoft. While, on the surface, the mnemonics appear cheesy (what is this, the high school science fair?), in practice they are easy to remember, easy to use, and relatively difficult to misunderstand. Can we apply the same kind of structured thinking to analyzing the trade offs in distributed systems we design? CALISDO is my first attempt at a mnemonic for doing STRIDE-style modeling of distributed systems designs. Consistency How do clients experience the consistency of data in the system? Availability How do clients experience the availability of the system for operations? Latency How long does it take for operations to complete? If the system is eventually consistent, how long does it take for data to be visible? Integrity Under what circumstances could data be corrupted? Scalability How does the system scale under load? Durability Under what circumstances could data be lost? Operational Costs What does it take to operate the system? How much will that cost? For Consistency, the focus is on client-visible guarantees, in the sense typically used by distributed systems (i.e. more closely related to A and I than C of ACID). Key questions: When is data visible to clients? How are concurrent updates handled? Are operations atomic from the client's perspective? Can the effects of rolled-back or aborted transactions be seen by other clients? For Availabil