Threat modeling (STRIDE, DREAD) in Cybersecurity - Mini Project: Build & Apply

Threat Modeling with STRIDE and DREAD

📖 Scenario: You are part of a small software team building a new web application. To keep the app safe, you need to identify possible security threats and understand their risks.This project will guide you through creating a simple threat model using the STRIDE and DREAD frameworks.

🎯 Goal: Build a basic threat model by listing threats using STRIDE categories, assigning risk scores with DREAD factors, and calculating overall risk levels.

📋 What You'll Learn

Create a dictionary of threats categorized by STRIDE factors

Add a dictionary of DREAD scores for each threat

Calculate risk scores by multiplying DREAD factors for each threat

Add a final risk level classification based on the calculated scores

💡 Why This Matters

🌍 Real World

Threat modeling helps teams find and understand security risks early in software development to prevent attacks.

💼 Career

Security analysts and developers use STRIDE and DREAD to assess and prioritize threats, improving software safety.

1

Create STRIDE Threat Categories

Create a dictionary called stride_threats with these exact keys and example threats:
'Spoofing': ['Fake login'], 'Tampering': ['Modify data'], 'Repudiation': ['Deny actions'], 'Information Disclosure': ['Leak data'], 'Denial of Service': ['Crash service'], 'Elevation of Privilege': ['Gain admin access']

Cybersecurity

# Create the stride_threats dictionary with the given keys and example threats
# Your code here

Hint

Use a dictionary with keys as STRIDE categories and values as lists of example threats.

2

Add DREAD Scores for Each Threat

Create a dictionary called dread_scores where each key is a threat name from stride_threats values and each value is another dictionary with DREAD factors: 'Damage Potential': 3, 'Reproducibility': 2, 'Exploitability': 4, 'Affected Users': 3, 'Discoverability': 2. Use these exact scores for all threats.

Cybersecurity

stride_threats = {
    'Spoofing': ['Fake login'],
    'Tampering': ['Modify data'],
    'Repudiation': ['Deny actions'],
    'Information Disclosure': ['Leak data'],
    'Denial of Service': ['Crash service'],
    'Elevation of Privilege': ['Gain admin access']
}
# Create the dread_scores dictionary with DREAD factors for each threat
# Your code here

Hint

Use a dictionary where each threat name maps to another dictionary of DREAD factors with the given scores.

3

Calculate Risk Scores for Each Threat

Create a dictionary called risk_scores where each key is a threat name from dread_scores and the value is the product of all its DREAD factor scores. Use a for loop with variables threat and factors to iterate over dread_scores.items().

Cybersecurity

stride_threats = {
    'Spoofing': ['Fake login'],
    'Tampering': ['Modify data'],
    'Repudiation': ['Deny actions'],
    'Information Disclosure': ['Leak data'],
    'Denial of Service': ['Crash service'],
    'Elevation of Privilege': ['Gain admin access']
}

dread_scores = {
    'Fake login': {'Damage Potential': 3, 'Reproducibility': 2, 'Exploitability': 4, 'Affected Users': 3, 'Discoverability': 2},
    'Modify data': {'Damage Potential': 3, 'Reproducibility': 2, 'Exploitability': 4, 'Affected Users': 3, 'Discoverability': 2},
    'Deny actions': {'Damage Potential': 3, 'Reproducibility': 2, 'Exploitability': 4, 'Affected Users': 3, 'Discoverability': 2},
    'Leak data': {'Damage Potential': 3, 'Reproducibility': 2, 'Exploitability': 4, 'Affected Users': 3, 'Discoverability': 2},
    'Crash service': {'Damage Potential': 3, 'Reproducibility': 2, 'Exploitability': 4, 'Affected Users': 3, 'Discoverability': 2},
    'Gain admin access': {'Damage Potential': 3, 'Reproducibility': 2, 'Exploitability': 4, 'Affected Users': 3, 'Discoverability': 2}
}

# Calculate risk_scores by multiplying all DREAD factors for each threat
# Your code here

Hint

Use nested loops: outer loop over dread_scores items, inner loop to multiply factor values.

4

Classify Threats by Risk Level

Create a dictionary called risk_levels where each key is a threat name from risk_scores and the value is a string: 'High' if the risk score is 100 or more, otherwise 'Medium'. Use a for loop with variables threat and score to iterate over risk_scores.items().

Cybersecurity

stride_threats = {
    'Spoofing': ['Fake login'],
    'Tampering': ['Modify data'],
    'Repudiation': ['Deny actions'],
    'Information Disclosure': ['Leak data'],
    'Denial of Service': ['Crash service'],
    'Elevation of Privilege': ['Gain admin access']
}

dread_scores = {
    'Fake login': {'Damage Potential': 3, 'Reproducibility': 2, 'Exploitability': 4, 'Affected Users': 3, 'Discoverability': 2},
    'Modify data': {'Damage Potential': 3, 'Reproducibility': 2, 'Exploitability': 4, 'Affected Users': 3, 'Discoverability': 2},
    'Deny actions': {'Damage Potential': 3, 'Reproducibility': 2, 'Exploitability': 4, 'Affected Users': 3, 'Discoverability': 2},
    'Leak data': {'Damage Potential': 3, 'Reproducibility': 2, 'Exploitability': 4, 'Affected Users': 3, 'Discoverability': 2},
    'Crash service': {'Damage Potential': 3, 'Reproducibility': 2, 'Exploitability': 4, 'Affected Users': 3, 'Discoverability': 2},
    'Gain admin access': {'Damage Potential': 3, 'Reproducibility': 2, 'Exploitability': 4, 'Affected Users': 3, 'Discoverability': 2}
}

risk_scores = {}
for threat, factors in dread_scores.items():
    score = 1
    for value in factors.values():
        score *= value
    risk_scores[threat] = score

# Create risk_levels dictionary classifying threats as 'High' or 'Medium'
# Your code here

Hint

Use a for loop over risk_scores items and an if-else to assign risk levels.

Practice

1. What is the main purpose of threat modeling in cybersecurity?

easy

A. To identify and prioritize potential security risks before they happen

B. To write code faster

C. To design user interfaces

D. To monitor network traffic in real-time

Solution

1. Step 1: Understand the goal of threat modeling

   Threat modeling is used to find security risks early in a system or application.

2. Step 2: Identify the main benefit

   It helps prioritize which risks to fix first to prevent harm.

3. Final Answer:

   To identify and prioritize potential security risks before they happen -> Option A

4. Quick Check:

   Threat modeling = find and rank risks [OK]

Hint: Threat modeling = find risks early and rank them [OK]

Common Mistakes:

• Confusing threat modeling with coding or UI design
• Thinking it monitors live traffic
• Assuming it fixes risks automatically

2. Which of the following correctly lists categories from the STRIDE threat model?

easy

A. Security, Trust, Reliability, Integrity, Data, Encryption

B. Scanning, Testing, Reporting, Investigating, Defending, Encrypting

C. Spoofing, Testing, Reporting, Information, Denial, Elevation

D. Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege

Solution

1. Step 1: Recall STRIDE categories

   STRIDE stands for Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege.

2. Step 2: Match options to STRIDE

   Only Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege lists all correct STRIDE categories in full.

3. Final Answer:

   Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege -> Option D

4. Quick Check:

   STRIDE = STRIDE categories [OK]

Hint: STRIDE is an acronym for six threat types [OK]

Common Mistakes:

• Mixing unrelated security terms
• Partial or incorrect category names
• Assuming STRIDE includes testing or encryption

3. Given a threat scored in DREAD as follows: Damage potential=3, Reproducibility=2, Exploitability=4, Affected users=3, Discoverability=1. What is the total DREAD score?

medium

A. 13

B. 12

C. 10

D. 9

Solution

1. Step 1: Add all DREAD components

   Sum the scores: 3 + 2 + 4 + 3 + 1 = 13.

2. Step 2: Verify calculation

   Check each value carefully to avoid mistakes.

3. Final Answer:

   13 -> Option A

4. Quick Check:

   Sum of DREAD scores = 13 [OK]

Hint: Add all five DREAD scores to get total [OK]

Common Mistakes:

• Forgetting one category in sum
• Adding incorrectly
• Confusing DREAD with STRIDE categories

4. A security analyst uses STRIDE but mistakenly includes 'Encryption' as a category. What is the error in this approach?

medium

A. Encryption is part of STRIDE under Denial of Service

B. Encryption is not a STRIDE threat category; it is a security control

C. Encryption is a DREAD scoring factor

D. Encryption is a type of Repudiation threat

Solution

1. Step 1: Understand STRIDE categories

   STRIDE categories are specific threat types, not security controls.

2. Step 2: Identify role of encryption

   Encryption is a defense method, not a threat category.

3. Final Answer:

   Encryption is not a STRIDE threat category; it is a security control -> Option B

4. Quick Check:

   Encryption = control, not STRIDE threat [OK]

Hint: STRIDE lists threats, not defenses like encryption [OK]

Common Mistakes:

• Confusing security controls with threat categories
• Mixing STRIDE and DREAD concepts
• Assuming encryption causes threats

5. You have two threats: Threat A with DREAD scores (Damage=5, Reproducibility=3, Exploitability=4, Affected Users=2, Discoverability=3) and Threat B with scores (Damage=4, Reproducibility=4, Exploitability=3, Affected Users=5, Discoverability=2). Which threat should be fixed first based on DREAD, and why?

hard

A. Threat B, because it has higher reproducibility

B. Threat A, because its total DREAD score is higher indicating greater risk

C. Threat B, because it has the higher total DREAD score indicating greater risk

D. Threat A, because it has higher damage potential only

Solution

1. Step 1: Calculate total DREAD scores for both threats

   Threat A: 5+3+4+2+3=17; Threat B: 4+4+3+5+2=18.

2. Step 2: Compare total scores and interpret

   Threat B has a higher total score (18) than Threat A (17), so Threat B is higher risk.

3. Step 3: Re-examine options carefully

   Threat A, because its total DREAD score is higher indicating greater risk incorrectly states Threat A has higher score. Options C and D focus on single factors instead of total score.

4. Final Answer:

   Threat B, because it has the higher total DREAD score indicating greater risk -> Option C

5. Quick Check:

   Total DREAD score guides priority [OK]

Hint: Sum DREAD scores; higher total means higher priority [OK]

Common Mistakes:

• Choosing based on one factor only
• Misadding scores
• Ignoring total DREAD score