Digital twin threat modeling examines how identity, data, models, timing, software, people, suppliers, and control authority interact across a physical/digital system. The analysis should connect each credible failure to affected assets, observable evidence, physical consequences, preventive and detective controls, recovery decisions, and residual uncertainty.
1. Define purpose and authority
State what the twin observes, predicts, recommends, optimizes, or controls. Identify decisions that could affect safety, privacy, quality, availability, finance, or the environment.
2. Trace trust boundaries
Follow state from physical source through sensing, edge, transport, ingestion, storage, models, APIs, people, decisions, and commands. Include development, vendors, updates, and recovery.
3. Test assumptions
Ask what happens when a trusted source lies, two sources disagree, time is wrong, a model is authentic but unsuitable, or an authorized command is unsafe.
4. Design evidence and recovery
Specify what will expose the failure, reconstruct the decision, establish authoritative state, and permit safe resynchronization.
Related resources
References
- NIST SP 800-160 Vol. 1 Rev. 1: Engineering Trustworthy Secure SystemsNIST · 2022 · Systems-security engineering guidance
Principles and life-cycle activities for engineering trustworthy secure systems.
- NIST SP 800-82 Rev. 3: Guide to Operational Technology (OT) SecurityNIST · 2023 · Government guidance
Security guidance for OT while accounting for performance, reliability, and safety requirements.
- NIST IR 8356: Security and Trust Considerations for Digital Twin TechnologyNIST · 2025 · Government research publication
Primary NIST treatment of digital-twin characteristics, cybersecurity, and trust considerations.