Governance, Risk, and Compliance · Topic 6 of 7
Threat Modeling Methods
Choose and apply threat modeling methods such as STRIDE, DREAD, attack trees, PASTA, MITRE ATT&CK, CAPEC, the Cyber Kill Chain and the Diamond Model.
- 4 min
- Threat modeling identifies threats at design time and prioritizes controls.
- STRIDE categories map to authentication, integrity, non-repudiation, confidentiality, availability and authorization.
- DREAD ranks threats by five factors, but its scoring is subjective.
What it is
Threat modeling is a structured way to find how a system could be attacked, so that defenses are chosen before the weakness is exploited. It asks what you are building, what can go wrong, what you will do about it, and whether you did enough.
It works on designs as well as running systems. Modeling early is cheaper than fixing a flaw after release.
How it works
Attack surface
The attack surface is the sum of the places where an attacker can try to enter or extract data. It is found through architecture reviews, data flow diagrams, code review and an asset inventory. Mergers, acquisitions, staffing changes and new cloud services all change it.
A data flow diagram shows processes, data stores, external entities and the flows between them. Trust boundaries mark where data crosses between zones of different trust, and these crossings are the most interesting places to look for threats.
Inputs to the model
For each threat, the model considers the adversary and the path.
- Adversary capability: skill, resources and motivation, from opportunistic criminals to nation states.
- Attack vector: how the attacker reaches the target, such as email, an exposed service or a supplier.
- Impact and likelihood: how bad it would be and how probable, which feed risk ranking.
Methods and frameworks
| Method | What it gives you |
|---|---|
| STRIDE (Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege) | A list of threat categories to apply to each component |
| DREAD (Damage, Reproducibility, Exploitability, Affected users, Discoverability) | A scoring scheme to rank threats |
| Attack tree | A diagram that breaks an attacker goal into steps |
| Process for Attack Simulation and Threat Analysis (PASTA) | A risk centric, staged process linking threats to business impact |
| MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) | A knowledge base of real adversary tactics and techniques |
| Common Attack Pattern Enumeration and Classification (CAPEC) | A catalog of attack patterns |
| Cyber Kill Chain | A seven stage model of an intrusion |
| Diamond Model | Relates adversary, capability, infrastructure and victim |
STRIDE and the property it breaks
Each STRIDE category maps to a security property that it violates.
| Threat | Property violated | Typical control |
|---|---|---|
| Spoofing | Authentication | Strong authentication |
| Tampering | Integrity | Hashing, signing, access control |
| Repudiation | Non-repudiation | Audit logs, digital signatures |
| Information disclosure | Confidentiality | Encryption, access control |
| Denial of service | Availability | Redundancy, rate limiting |
| Elevation of privilege | Authorization | Least privilege, input validation |
DREAD and attack trees
DREAD rates a threat on five factors. It is easy to explain, but the scores are subjective, so teams often prefer other rating methods.
An attack tree puts the attacker goal at the root, and branches show alternative or combined ways to reach it. OR branches are alternatives, while AND branches need every child step. The cheapest or likeliest path shows where to place a control.
Attack frameworks for adversary behavior
MITRE ATT&CK organizes adversary behavior as tactics (the goal, such as persistence) and techniques (the method). Use it to map detections and test coverage.
The Cyber Kill Chain has seven stages: reconnaissance, weaponization, delivery, exploitation, installation, command and control, and actions on objectives. Breaking the chain early limits damage.
The Diamond Model links four features of an event: adversary, capability, infrastructure and victim. It helps analysts pivot from one known feature to the others.
Choosing a method
Choose by question. For design review of a new application, use STRIDE with a data flow diagram.
To plan detection around a known threat actor, use ATT&CK. To show executives the business link, use PASTA or a risk register.
What to remember for the exam
- Threat modeling identifies threats at design time and prioritizes controls.
- STRIDE categories map to authentication, integrity, non-repudiation, confidentiality, availability and authorization.
- DREAD ranks threats by five factors, but its scoring is subjective.
- Attack trees use OR and AND nodes, with the goal at the root.
- ATT&CK describes real adversary tactics and techniques, which supports detection mapping.
- The Cyber Kill Chain has seven stages, and the earlier you disrupt it the better.
- Trust boundaries on a data flow diagram are prime places to look for threats.
- Changes such as acquisitions and new cloud services change the attack surface and need a refreshed model.
If a question asks for a way to categorize threats to a design component, think STRIDE. If it asks about real attacker behavior, think ATT&CK.
Common mistakes
Confusing STRIDE with DREAD. STRIDE identifies the kind of threat, and DREAD scores how serious it is.
Modeling once and filing it. The model must be revisited after significant change.
Ignoring non-technical vectors. Social engineering, suppliers and insiders belong in the model.
Mistaking the Kill Chain for ATT&CK. The Kill Chain is a linear sequence of stages, while ATT&CK is a broad matrix of tactics and techniques.
Check yourself
Work through these three questions.
Which STRIDE category violates integrity?
Tampering.
What does an AND node in an attack tree mean?
The attacker must complete every child step to reach the parent goal, whereas OR nodes offer alternatives.
Which framework catalogs real adversary tactics and techniques for mapping detections?
MITRE ATT&CK.
Topic 6 of 7 in Governance, Risk, and Compliance
Test yourself on Governance, Risk, and Compliance
The full CompTIA SecurityX CAS-005 question bank has 654 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.