The Human HARMS: A different approach to threat modelling

By Kieron Ivy Turk, Anna Talas, Prof. Alice Hutchings When talking about the importance of cybersecurity, we often imagine hackers breaking into high security systems to steal data, money or launch large-scale attacks. However, technology can also be used for harm in everyday situations. Traditional cybersecurity models tend to focus on protecting systems from highly skilled external threats. While these models are effective in cybersecurity, they do not adequately address interpersonal threats that often do not require a lot of technical skill—such as those found in cases of domestic abuse. The HARMS model ( Harassment, Access and infiltration, Restrictions, Manipulation and tampering, and Surveillance) is a new threat modelling framework designed to identify non-technical and human factors harms that are often missed by popular frameworks such as STRIDE. We focused on how everyday technology, such as IoT devices, can be exploited to distress, control or intimidate others. The fi...