# LINDDUN Privacy Threat Modeling — Standards References

## Primary References

### LINDDUN Methodology
- **Authors**: Mina Deng, Kim Wuyts, Riccardo Scandariato, Bart Preneel, Wouter Joosen
- **Institution**: DistriNet Research Group, KU Leuven
- **Original Paper**: "A Privacy Threat Analysis Framework: Supporting the Elicitation and Fulfillment of Privacy Requirements." Requirements Engineering, 16(1):3-32, 2011.
- **LINDDUN GO**: Lightweight version for agile teams (linddun.org)

### ISO/IEC 29100:2011 — Privacy Framework
- **Relevance**: Defines privacy properties that LINDDUN threats violate (unlinkability, anonymity, plausible deniability, undetectability, confidentiality, content awareness, policy compliance)

### OWASP Privacy Risks Project
- **Relevance**: Complements LINDDUN with web-application-specific privacy risks

## Supplementary Standards

### STRIDE Threat Modeling (Microsoft)
- **Relevance**: Security threat model that complements LINDDUN for comprehensive threat analysis

### NIST SP 800-154 — Guide to Data-Centric System Threat Modeling
- **Published**: March 2016
- **Relevance**: Data-centric threat modeling approach compatible with LINDDUN

### ISO/IEC 27005:2022 — Information Security Risk Management
- **Relevance**: Risk assessment methodology applicable to LINDDUN threat prioritization

## Regulatory Context

### GDPR
- Article 25: Data protection by design (threat modeling as engineering practice)
- Article 35: DPIA (LINDDUN as threat identification input)

### NIST Privacy Framework
- ID.RA: Risk Assessment (LINDDUN provides structured threat identification)