STRIDE Threat Model
The following metrics summarize risk concentration by severity tier. Severity reflects potential impact assuming successful exploitation, prior to control effectiveness adjustments.
Data Flow Diagram showing system components organized by trust zones. Click on components to highlight connected data flows.
Data flows crossing trust boundaries require additional security scrutiny.
Risks are prioritized by severity tier (Critical → Low) and CVSS score within each tier. Ratings represent base technical severity prior to control effectiveness adjustments.
An external attacker who gains a foothold in the DMZ can impersonate the API Gateway when calling the API Layer because the gateway→API service identity (mTLS/JWT) is not documented. The attacker forges internal requests that appear “from gateway” to reach Orchestration and session-dependent APIs.
An external attacker or malicious insider steals the Azure OpenAI API key (key lifecycle/scoping not documented) from configs, CI/CD, or logs. The attacker then impersonates the Orchestration Layer to send prompts containing stolen PII or to exfiltrate model outputs, consuming quota and bypassing business logic controls.
An attacker who steals or guesses a partner API key can replay it against Partner Widget Integrations because API keys are weaker than OAuth and are not bound to mTLS/JWT. They can impersonate a licensed aggregator and access partner-only functions or data beyond the user’s consent scope.
An attacker in the on-prem environment or along misconfigured hybrid routing impersonates the fallback LLM endpoint because the ExpressRoute flow lacks documented encryption/auth. Orchestration may accept responses as “trusted on-prem model output,” enabling identity misrepresentation and malicious completions under a trusted path.
A malicious insider or compromised pipeline injects a RAG document that imitates official bank procedures (“reset MFA by collecting OTP in chat”). When retrieved, the LLM treats it as authoritative source and outputs spoofed guidance under the bank’s identity, bypassing normal policy controls.
An attacker steals the Pinecone API key (rotation/scoping not described) and inserts or modifies vectors/metadata in the US-East index. Queries then retrieve attacker-chosen documents, enabling deceptive answers and identity misuse (e.g., fake support instructions) despite correct user auth.
A criminal attacker obtains the SMS Gateway API key (controls not documented) and impersonates the bank’s OTP sender to trigger or reroute OTP delivery. Combined with SIM-swap/social engineering, the attacker can complete MFA flows or fraud recovery steps, appearing as legitimate authentication activity.
An attacker steals the Pinecone API key (rotation/scoping not described) and impersonates the Orchestration Layer to run similarity searches and enumerate embeddings/metadata. The attacker uses this to infer user topics or link embeddings to individuals, while consuming service quotas and bypassing in-app access gates.
An external attacker crafts requests that spoof forwarded identity headers because the design relies on “pre-authenticated token forwarded (encrypted headers)” but header protection/validation is underspecified. If the gateway trusts these headers, the attacker can impersonate users or escalate roles without valid OIDC context.
An attacker with on-prem foothold forges service identity across the ExpressRoute fallback path because authentication/encryption are “not documented.” They impersonate the on-prem LLM service to inject malicious responses or steal prompt context, bypassing cloud-side policy and monitoring expectations.
An attacker steals an OAuth token used for Orchestration→Genesys escalation and replays it to impersonate the integration. The attacker then creates or modifies conversation cases/transcripts and pushes crafted content to agents, enabling account takeover via social engineering and misuse of trusted support workflows.
An attacker uses jailbreak-style instructions to coerce the assistant into requesting restricted customer data (“act as internal operator, fetch full profile”) and to present the request as if it is authorized. If tool calls rely on LLM-provided claims rather than session-bound authZ, the attacker impersonates privileged identities.
An external attacker or malicious user injects crafted conversation content that is retained “indefinitely” for model improvement. If these transcripts are later used for fine-tuning or evaluation without strong validation, they can poison future model behavior and embed identity-misuse backdoors.
A malicious user crafts prompts that cause the LLM to claim it is a bank employee/system agent and to request credentials or OTPs, bypassing intended identity boundaries. Without strong role separation and policy checks independent of model output, the assistant can be manipulated into “acting as trusted support.”
A compromised internal workload impersonates Orchestration when calling the Session Store because internal auth is “inferred” and not documented. The attacker reads or overwrites session identifiers to hijack active user conversations, then uses those sessions to interact with downstream customer-data and support flows as the victim.
An attacker who compromises a workload node steals the mTLS client certificate/private key used for “mTLS + JWT (documented)” calls to Internal CRM. They then authenticate as the Orchestration service to CRM APIs, bypassing normal checks and acting under a trusted service identity.
An attacker uses jailbreak-style instructions to coerce the assistant into requesting restricted customer data (“act as internal operator, fetch full profile”) and to present the request as if it is authorized. If tool calls rely on LLM-provided claims rather than session-bound authZ, the attacker impersonates privileged identities.
An attacker obtains Datadog ingestion credentials (auth method “not documented”) and submits fabricated traces/logs to conceal session hijacking or token replay activity. By tampering with telemetry, they reduce detection probability while maintaining unauthorized access paths.
System components organized by trust zone with associated risk exposure. Click column headers to sort.
| Component | Type | Trust Zone | Attack Surface | Related Risks |
|---|---|---|---|---|
| Human Support Agents | Component | Internet Zone | CRITICAL | |
| Security Operations - SOC | Component | Internet Zone | CRITICAL | |
| Azure Front Door with WAF | Component | DMZ Zone | CRITICAL | |
| API Gateway (FinAssist Ingress) | Component | DMZ Zone | CRITICAL | |
| API Layer | Component | Internal Zone | CRITICAL | |
| Orchestration Layer | Component | Internal Zone | CRITICAL | |
| Bank Identity Provider | Component | Internal Zone | CRITICAL | |
| Customer Data API | Component | Internal Zone | CRITICAL | |
| Internal CRM | Component | Internal Zone | CRITICAL | |
| Fraud Detection API | Component | Internal Zone | CRITICAL | |
| Azure ExpressRoute | Component | Internal Zone | CRITICAL | |
| Session Store | Datastore | Data Zone | CRITICAL | |
| Conversation Logs | Datastore | Data Zone | CRITICAL | |
| Model Improvement Dataset - Anonymized Transcripts | Datastore | Data Zone | CRITICAL | |
| Partner Integration Logging Store | Datastore | Data Zone | CRITICAL | |
| Azure OpenAI Service | Component | Third Party Zone | CRITICAL | |
| Azure OpenAI Embeddings Model | Component | Third Party Zone | CRITICAL | |
| Pinecone Vector DB Service | Component | Third Party Zone | CRITICAL | |
| SMS Gateway | Component | Third Party Zone | CRITICAL | |
| Azure Monitor | Component | Third Party Zone | CRITICAL | |
| Retail Banking Customers | Component | Internet Zone | HIGH | 0 |
| Unauthenticated Users | Component | Internet Zone | HIGH | |
| Third-party Application Users | Component | Internet Zone | HIGH | |
| Third-party Financial Aggregators - PSD2 licensed | Component | Internet Zone | HIGH | |
| Partner Widget Integrations | Component | DMZ Zone | HIGH | |
| Context Builder | Component | Internal Zone | HIGH | |
| Response Filtering | Component | Internal Zone | HIGH | |
| RAG Source Documents Storage | Datastore | Data Zone | HIGH | |
| Genesys Cloud | Component | Third Party Zone | HIGH | |
| Datadog APM | Component | Third Party Zone | MEDIUM | |
| Azure DevOps CI-CD | Component | Third Party Zone | MEDIUM |
Prioritized remediation plan for critical and high severity findings with recommended controls.
| Risk | Finding & Recommended Control | Severity | Timeline |
|---|---|---|---|
| RISK-002 |
DMZ-to-Internal Service Impersonation Due to Missing S2S Identity
Enforce mTLS with SPIFFE/SPIRE or cloud workload identity between API Gateway and API Layer; reject non-mTLS traffic at service mesh/ingress.
|
CRITICAL | Immediate (0-30 days) |
| RISK-005 |
Azure OpenAI API Key Theft Enables Unauthorized LLM Usage and Data Exposure
Replace static API keys with managed identity/OAuth where supported; otherwise store keys in a secrets manager with strict RBAC and just-in-time retrieval.
|
CRITICAL | Immediate (0-30 days) |
| RISK-009 |
Partner API Key Replay Enables Aggregator Impersonation and Consent Abuse
Replace partner API keys with OAuth2 client credentials + mTLS (RFC 8705) so partner identity is cryptographically bound to a certificate.
|
CRITICAL | Immediate (0-30 days) |
| RISK-013 |
Hybrid Fallback LLM Impersonation Over ExpressRoute Breaks Trust Boundary
Implement mTLS end-to-end over the ExpressRoute path with strict certificate pinning/allowlisting of fallback LLM service identity.
|
CRITICAL | Immediate (0-30 days) |
| RISK-015 |
Indirect Prompt Injection via RAG Documents Spoofs Bank Policy Guidance
Implement signed/attested RAG ingestion: only accept documents from approved pipelines; verify signatures and provenance before indexing.
|
CRITICAL | Immediate (0-30 days) |
| RISK-001 |
Edge Identity Header Spoofing/Tampering Enables User Impersonation
Use standard OIDC token transmission (Authorization: Bearer) end-to-end; avoid custom identity headers unless cryptographically signed.
|
HIGH | Near-term (30-90 days) |
| RISK-003 |
Internal/Hyrbid Traffic Sniffing Captures Tokens and Enables Replay
Enforce mTLS with mutual certificate authentication between Orchestration Layer and on-prem LLM endpoints; validate service identity and pin to expected SANs.
|
HIGH | Near-term (30-90 days) |
| RISK-004 |
Session Store Hijack/Fixation via Weak Binding and Replay
Require mTLS + workload identity (service account/managed identity) for Session Store access; enforce ACLs per service identity.
|
HIGH | Near-term (30-90 days) |
| RISK-006 |
Pinecone API Key Abuse Enables Unauthorized Vector Queries and Cost/Privacy Impact
Use private connectivity (where available) and strict egress controls so only Orchestration can reach Pinecone; deny public internet access paths.
|
HIGH | Near-term (30-90 days) |
| RISK-007 |
RAG/Vector Index Tampering Poisons Retrieval Integrity
Use separate Pinecone projects/indices per environment and per tenant where applicable; enforce least-privilege API keys (read-only for query paths, write-only for ingestion).
|
HIGH | Near-term (30-90 days) |
Timeline: Immediate (0-30 days) | Near-term (30-90 days) | Strategic (>90 days)
This section documents the scope, basis, methodology, and limitations of this threat assessment to ensure clarity for audit, compliance, and governance purposes.
Consolidated STRIDE threat modeling outputs focused on identity, secrets, session/token handling, hybrid connectivity, and LLM/RAG integrity across a multi-provider banking assistant platform.
20 components were analyzed as part of this assessment. See Component Inventory for the complete list with trust zone assignments.
This assessment is based on the following input artifacts and data sources:
| Input Artifact | Status / Description |
|---|---|
| ✓ Data Flow Diagram (DFD) | System architecture with trust boundaries |
| ✓ Architecture Documentation | System description and component overview |
| ✓ Threat Analysis | 18 risks identified via STRIDE analysis |
| ✓ MITRE ATT&CK Mapping | Threat-to-technique correlation |
No additional documentation or stakeholder interviews were provided beyond the artifacts listed above.
This assessment applies the STRIDE threat modeling framework as defined by Microsoft. STRIDE is a widely adopted industry framework for architectural threat modeling, particularly for distributed and cloud-native systems. Threats are systematically analyzed across six categories: Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege.
Severity Rating: Risk severity is determined using CVSS v3.1 base scores aligned to standard severity bands (Critical ≥9.0, High 7.0-8.9, Medium 4.0-6.9, Low <4.0). See Appendix C: Severity Rating Methodology for details.
Risk Prioritization: Beyond CVSS scoring, risks are prioritized based on business context, threat consolidation (merged related threats), and attack surface exposure. Risks with CVSS ≥8.5 may be elevated to Critical when composite factors indicate systemic risk.
Threat Intelligence: Identified threats are mapped to MITRE ATT&CK techniques, MITRE ATLAS (AI/ML threats), CAPEC attack patterns, and CWE weakness categories where applicable, providing industry-standard reference points.
Compliance Alignment: Risks are mapped to applicable regulatory frameworks including DORA, NIS2, GDPR, NIST CSF, ISO 27001, PCI-DSS, and SWIFT CSCF where control requirements align with identified threats.
The following assumptions were made during this assessment:
Supporting documentation, methodology details, and technical references.
Mermaid diagram source code for reference and customization. Copy and modify in any Mermaid-compatible editor (VS Code, Notion, GitHub, Mermaid Live Editor).
flowchart TB
subgraph Internet_Zone[INTERNET ZONE]
A_Retail_Banking_Customers(["Retail<br/>Banking Customers"])
A_Unauthenticated_Users(["Unauth<br/>Users"])
A_Third_party_Application_Users(["Third-party<br/>App Users"])
C_Third_party_Financial_Aggregators_PSD2_licensed(("PSD2 licensed<br/>Third-party…"))
C_Human_Support_Agents(("Human<br/>Support Agents"))
C_Security_Operations_SOC(("SOC<br/>Security Operations"))
end
subgraph DMZ_Zone[DMZ ZONE]
C_Azure_Front_Door_with_WAF(("Front<br/>Door with WAF"))
C_API_Gateway_FinAssist_Ingress(("API<br/>Gateway (FinAssist…"))
ES_Partner_Widget_Integrations{{"Partner<br/>Widget Integrations"}}
end
subgraph Internal_Zone[INTERNAL ZONE]
C_FinAssist_AI_Platform(("FinAssist<br/>AI"))
C_API_Layer(("API<br/>Layer"))
C_Orchestration_Layer(("Orch<br/>Layer"))
C_Context_Builder(("Context<br/>Builder"))
C_Response_Filtering(("Response<br/>Filtering"))
ES_Bank_Identity_Provider{{"Bank<br/>Identity Provider"}}
A_Customer_Data_API(["Customer<br/>Data API"])
C_Internal_CRM(("Internal<br/>CRM"))
C_Fraud_Detection_API(("Fraud<br/>Detect API"))
C_Kubernetes_Network_Policies(("K8s<br/>Network Policies"))
C_Azure_ExpressRoute(("ExpressRoute<br/>Azure"))
end
subgraph Data_Zone[DATA ZONE]
DS_Session_Store[("Session<br/>Store")]
DS_RAG_Source_Documents_Storage[("RAG<br/>Source Documents…")]
DS_Conversation_Logs[("Conv<br/>Logs")]
DS_Model_Improvement_Dataset_Anonymized_Transcripts[("Anonymized…<br/>Model Improvement…")]
DS_Partner_Integration_Logging_Store[("Partner<br/>Integr Logging Store")]
end
subgraph Third_Party_Zone[THIRD-PARTY ZONE]
ES_Azure_OpenAI_Service{{"OpenAI<br/>Svc"}}
ES_Azure_OpenAI_Embeddings_Model{{"OpenAI<br/>Embeddings Model"}}
ES_Pinecone_Vector_DB_Service{{"Pinecone<br/>Vector DB Svc"}}
ES_Genesys_Cloud{{"Genesys<br/>Cloud"}}
ES_SMS_Gateway{{"SMS<br/>Gateway"}}
C_Azure_Monitor(("Monitor<br/>Azure"))
C_Datadog_APM(("Datadog<br/>APM"))
C_Azure_DevOps_CI_CD(("DevOps<br/>CI-CD"))
end
subgraph On_Premise_Zone[ON-PREMISE ZONE]
ES_On_premise_GPU_Cluster_Fallback_LLM{{"On-premise<br/>GPU Cluster…"}}
end
%% Data Flows
A_Retail_Banking_Customers -->|HTTPS-TLS1_3| C_Azure_Front_Door_with_WAF
C_Azure_Front_Door_with_WAF -->|HTTPS-TLS1_3| C_API_Gateway_FinAssist_Ingress
C_API_Gateway_FinAssist_Ingress -->|Internal RPC - inferred| C_API_Layer
C_API_Layer -->|Internal RPC - inferred| C_Orchestration_Layer
C_Orchestration_Layer -->|REST-HTTPS - assumed| ES_Bank_Identity_Provider
ES_Bank_Identity_Provider -->|REST-HTTPS - assumed| C_Orchestration_Layer
A_Unauthenticated_Users -->|HTTPS-TLS1_3| C_Azure_Front_Door_with_WAF
C_Third_party_Financial_Aggregators_PSD2_licensed -->|HTTPS - assumed| ES_Partner_Widget_Integrations
ES_Partner_Widget_Integrations -->|Internal RPC - inferred| DS_Partner_Integration_Logging_Store
C_Orchestration_Layer -->|Internal RPC - inferred| DS_Session_Store
DS_Session_Store -->|Internal RPC - inferred| C_Orchestration_Layer
C_Context_Builder -->|REST-HTTPS - assumed| A_Customer_Data_API
A_Customer_Data_API -->|REST-HTTPS - assumed| C_Context_Builder
C_Orchestration_Layer -->|mTLS + JWT - documented| C_Internal_CRM
C_Internal_CRM -->|mTLS + JWT - documented| C_Orchestration_Layer
C_Orchestration_Layer -->|mTLS - documented| C_Fraud_Detection_API
C_Fraud_Detection_API -->|mTLS - documented| C_Orchestration_Layer
C_Orchestration_Layer -->|REST-HTTPS - assumed| ES_Azure_OpenAI_Service
ES_Azure_OpenAI_Service -->|REST-HTTPS - assumed| C_Orchestration_Layer
C_Orchestration_Layer -->|REST-HTTPS - assumed| ES_Azure_OpenAI_Embeddings_Model
ES_Azure_OpenAI_Embeddings_Model -->|REST-HTTPS - assumed| C_Orchestration_Layer
C_Orchestration_Layer -->|REST-HTTPS - assumed| ES_Pinecone_Vector_DB_Service
ES_Pinecone_Vector_DB_Service -->|REST-HTTPS - assumed| C_Orchestration_Layer
C_Orchestration_Layer -->|HTTPS - assumed| DS_RAG_Source_Documents_Storage
DS_RAG_Source_Documents_Storage -->|HTTPS - assumed| C_Orchestration_Layer
C_Orchestration_Layer -->|Internal RPC - inferred| C_Response_Filtering
C_Response_Filtering -->|Internal RPC - inferred| C_Orchestration_Layer
C_FinAssist_AI_Platform -->|Internal RPC - inferred| DS_Conversation_Logs
C_Orchestration_Layer -->|REST-HTTPS - assumed| ES_Genesys_Cloud
ES_Genesys_Cloud -->|REST-HTTPS - assumed| C_Orchestration_Layer
ES_Genesys_Cloud -->|SaaS UI - HTTPS - assumed| C_Human_Support_Agents
C_Orchestration_Layer -->|REST-HTTPS - assumed| ES_SMS_Gateway
C_FinAssist_AI_Platform -->|HTTPS - assumed| C_Azure_Monitor
C_FinAssist_AI_Platform -->|HTTPS - assumed| C_Datadog_APM
C_Security_Operations_SOC -->|Portal-API - unspecified| C_Azure_Monitor
C_Security_Operations_SOC -->|Portal-API - unspecified| C_Datadog_APM
C_Orchestration_Layer -->|Internal RPC over ExpressRoute - inferred| C_Azure_ExpressRoute
C_Azure_ExpressRoute -->|Private link - inferred| ES_On_premise_GPU_Cluster_Fallback_LLM
ES_On_premise_GPU_Cluster_Fallback_LLM -->|Private link - inferred| C_Azure_ExpressRoute
C_Azure_ExpressRoute -->|Internal RPC over ExpressRoute - inferred| C_Orchestration_Layer
C_Azure_DevOps_CI_CD -->|CI-CD pipelines - HTTPS assumed| C_FinAssist_AI_Platform
%% Styling
style Internet_Zone fill:rgba(220, 38, 38, 0.15),stroke:#dc2626,stroke-width:2px
style DMZ_Zone fill:rgba(249, 115, 22, 0.15),stroke:#f97316,stroke-width:2px
style Internal_Zone fill:rgba(59, 130, 246, 0.15),stroke:#3b82f6,stroke-width:2px
style Data_Zone fill:rgba(34, 197, 94, 0.15),stroke:#22c55e,stroke-width:2px
style Third_Party_Zone fill:rgba(168, 85, 247, 0.15),stroke:#a855f7,stroke-width:2px
style On_Premise_Zone fill:rgba(59, 130, 246, 0.15),stroke:#3b82f6,stroke-width:2px
classDef actor fill:#134e4a,stroke:#14b8a6,stroke-width:2px,color:#5eead4
classDef process fill:#2e1065,stroke:#8b5cf6,stroke-width:2px,color:#c4b5fd
classDef datastore fill:#14532d,stroke:#22c55e,stroke-width:2px,color:#86efac
classDef external fill:#3b0764,stroke:#a855f7,stroke-width:2px,color:#d8b4fe
classDef core fill:#1e1b4b,stroke:#8b5cf6,stroke-width:4px,color:#c4b5fd
class A_Retail_Banking_Customers,A_Unauthenticated_Users,A_Third_party_Application_Users,A_Customer_Data_API actor
class C_Third_party_Financial_Aggregators_PSD2_licensed,C_Human_Support_Agents,C_Security_Operations_SOC,C_Azure_Front_Door_with_WAF,C_API_Gateway_FinAssist_Ingress,C_FinAssist_AI_Platform,C_API_Layer,C_Orchestration_Layer,C_Context_Builder,C_Response_Filtering,C_Internal_CRM,C_Fraud_Detection_API,C_Kubernetes_Network_Policies,C_Azure_ExpressRoute,C_Azure_Monitor,C_Datadog_APM,C_Azure_DevOps_CI_CD process
class DS_Session_Store,DS_RAG_Source_Documents_Storage,DS_Conversation_Logs,DS_Model_Improvement_Dataset_Anonymized_Transcripts,DS_Partner_Integration_Logging_Store datastore
class ES_Partner_Widget_Integrations,ES_Bank_Identity_Provider,ES_Azure_OpenAI_Service,ES_Azure_OpenAI_Embeddings_Model,ES_Pinecone_Vector_DB_Service,ES_Genesys_Cloud,ES_SMS_Gateway,ES_On_premise_GPU_Cluster_Fallback_LLM external
This assessment uses a hybrid severity rating methodology that combines industry-standard CVSS v3.1 scoring with composite risk analysis.
Severity ratings are primarily determined by CVSS v3.1 Base Scores:
| Rating | CVSS Range | Description | Remediation Timeline |
|---|---|---|---|
| CRITICAL | 9.0 – 10.0 | Easily exploitable with severe impact. Requires immediate action. | Immediate (0-30 days) |
| HIGH | 7.0 – 8.9 | Significant risk requiring priority remediation. | Near-term (30-90 days) |
| MEDIUM | 4.0 – 6.9 | Moderate risk with exploitability or impact limitations. | Planned (90-180 days) |
| LOW | 0.1 – 3.9 | Minor risk. Risk acceptance may be appropriate. | Discretionary (180+ days) |
In limited cases, a risk with a High CVSS score (7.0-8.9) may be elevated to Critical when composite factors indicate systemic risk. Elevated risks are marked with ↑.
Note: This methodology ensures severity ratings remain aligned with CVSS standards while accounting for real-world risk amplification factors such as threat consolidation and business impact assessment.
Authoritative sources for frameworks, standards, and regulations referenced in this assessment.