Security and Risk Management · Topic 7 of 7
Threat Modeling and Supply Chain Risk
Threat modeling with STRIDE, PASTA, attack trees and data flow diagrams, and managing supply chain risk from hardware, software, services and third parties.
- 3 min
- STRIDE: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege.
- PASTA is a seven-stage, risk-centric method; attack trees map paths to a goal.
- Focus on trust boundaries in data flow diagrams.
What it is
Threat modeling is a structured way to find how a system could be attacked, ideally during design, so defenses are built in rather than bolted on. Supply chain risk management (SCRM) deals with the risk that comes from the products and services the organization buys: a compromise at a supplier can become a compromise of everyone who uses it.
How it works
Threat modeling methodologies
| Method | Focus |
|---|---|
| STRIDE | Threat categories: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege |
| PASTA | Process for Attack Simulation and Threat Analysis: a seven-stage, risk-centric process tied to business objectives |
| DREAD | Rating threats by damage, reproducibility, exploitability, affected users and discoverability |
| Attack trees | The attacker's goal at the root and ways to reach it as branches |
| VAST | Visual, agile and simple threat modeling that scales across teams |
STRIDE maps to the security properties each threat violates:
| STRIDE threat | Violates |
|---|---|
| Spoofing | Authenticity |
| Tampering | Integrity |
| Repudiation | Nonrepudiation |
| Information disclosure | Confidentiality |
| Denial of service | Availability |
| Elevation of privilege | Authorization |
Where to look
Draw a data flow diagram with processes, data stores, external entities and data flows, then mark trust boundaries. Flows that cross trust boundaries deserve the closest attention, because that is where an attacker can inject, intercept or alter data.
Threat modeling is most valuable early, during design. Changing a design is cheaper than changing a released product.
Supply chain risk
| Source of risk | Examples |
|---|---|
| Hardware | Tampered or counterfeit components, implants, compromised firmware |
| Software | Malicious updates, vulnerable or abandoned open-source libraries |
| Services | Cloud providers, managed service providers, outsourcers with access to your systems |
| People and logistics | Insiders at suppliers, insecure shipping and storage |
Supply chain controls
- Assess suppliers before purchase and periodically: questionnaires, audit reports such as SOC 2, on-site reviews for critical suppliers.
- Set minimum security requirements in contracts, with the right to audit and breach notification duties.
- Service level requirements for availability, response and support.
- Software bill of materials (SBOM) to know which components a product contains.
- Hardware assurance: silicon root of trust, physically unclonable functions, trusted suppliers and tamper-evident packaging.
- Monitor continuously: vendor risk ratings, news, vulnerabilities in supplied components.
- Plan for supplier failure: alternate suppliers, escrow, exit plans.
A worked scenario
A company relies on a managed service provider with administrative access to all its servers. The provider will not share any security evidence. The company should treat this as a high risk: require security terms in the contract and an independent audit report, restrict and monitor the provider's access, and plan an alternative if the provider will not comply.
How the exam asks about this
- "Where should threat analysis concentrate on a data flow diagram?" Flows crossing trust boundaries.
- "Which STRIDE category covers a user denying they sent a transaction?" Repudiation.
- "How do you learn which open-source libraries a purchased product contains?" Ask for an SBOM.
What to remember for the exam
- STRIDE: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege.
- PASTA is a seven-stage, risk-centric method; attack trees map paths to a goal.
- Focus on trust boundaries in data flow diagrams.
- Supply chain risk covers hardware, software, services and people.
- Contracts, assessments, SBOMs and monitoring manage supplier risk.
Outsourcing a function does not outsource accountability. The organization remains responsible for its data held by suppliers.
Common mistakes
Threat modeling only after release.
Trusting a supplier because it is large or well known. Ask for evidence.
Ignoring open-source dependencies inside purchased software.
Check yourself
Which STRIDE threat violates integrity?
Tampering.
What document lists the components inside a software product?
A software bill of materials (SBOM).
Why should threat modeling happen during design?
Changing a design is far cheaper than fixing a released product.
Topic 7 of 7 in Security and Risk Management
Test yourself on Security and Risk Management
The full ISC2 CISSP question bank has 1,113 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISC2. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.