Threat Modeling
STRIDE, DREAD, attack trees, and threat modeling methodologies.
Overview
Threat modeling identifies and prioritizes security threats.
STRIDE Model
| Category | Description | Example |
|---|---|---|
| Spoofing | Identity impersonation | Fake login |
| Tampering | Data modification | Man-in-the-middle |
| Repudiation | Denying actions | Log deletion |
| Information Disclosure | Data exposure | SQL injection |
| Denial of Service | Availability loss | DDoS |
| Elevation of Privilege | Unauthorized access | Privilege escalation |
DREAD Rating
DREAD Rating System:
| Letter | Factor | Description |
|---|---|---|
| D | Damage potential | How severe is the impact? |
| R | Reproducibility | How easy to reproduce? |
| E | Exploitability | How easy to exploit? |
| A | Affected users | How many users impacted? |
| D | Discoverability | How easy to find? |
Scoring: High (8-10), Medium (4-7), Low (1-3)
Attack Tree
Architecture Diagram
Goal: Steal customer data
+-- Compromise database
| +-- SQL injection
| +-- Credential theft
| +-- Backup exposure
+-- Intercept network traffic
| +-- Man-in-the-middle
| +-- Packet sniffing
+-- Social engineering
+-- Phishing
+-- Pretexting
Threat Model Process
Data Flow Diagram
Practice
Conduct threat modeling for a web application using STRIDE.