Threat modeling (STRIDE, DREAD) in Cybersecurity - Cheat Sheet & Quick Revision

Recall & Review

beginner

What does the STRIDE acronym stand for in threat modeling?

STRIDE stands for:

• Spoofing - pretending to be someone else
• Tampering - modifying data or code
• Repudiation - denying an action or transaction
• Information Disclosure - exposing information to unauthorized parties
• Denial of Service - making a service unavailable
• Elevation of Privilege - gaining higher access than allowed

beginner

What is the main purpose of threat modeling in cybersecurity?

Threat modeling helps identify, understand, and prioritize potential security threats to a system before they happen. It guides teams to design safer systems by thinking like attackers.

intermediate

How does the DREAD model help in threat assessment?

DREAD scores threats based on five factors:

• Damage potential - How bad is the damage?
• Reproducibility - How easy is it to repeat the attack?
• Exploitability - How easy is it to launch the attack?
• Affected users - How many users are impacted?
• Discoverability - How easy is it to find the vulnerability?

This helps prioritize which threats to fix first.

beginner

Give a real-life example of a Spoofing threat from STRIDE.

Example: Someone pretending to be a trusted friend by using their email address to send fake messages. This tricks the receiver into trusting the message and possibly sharing sensitive info.

beginner

Why is Denial of Service (DoS) considered a serious threat in STRIDE?

DoS attacks make a service or website unavailable by overwhelming it with traffic or requests. This can stop users from accessing important services, causing disruption and loss.

Which STRIDE category involves pretending to be someone else?

A Repudiation

B Tampering

C Spoofing

D Elevation of Privilege

Spoofing means pretending to be another user or system to gain unauthorized access.

In DREAD, what does 'Exploitability' measure?

A How many users are affected

B How easy it is to launch the attack

C How bad the damage is

D How easy it is to find the vulnerability

'Exploitability' measures how easy it is for an attacker to carry out the attack.

Which STRIDE threat involves unauthorized changes to data?

A Tampering

B Information Disclosure

C Denial of Service

D Repudiation

Tampering means modifying data or code without permission.

What is the main goal of threat modeling?

A To create software faster

B To design user interfaces

C To test software performance

D To identify and prioritize security risks

Threat modeling helps find and rank security risks to protect systems better.

Which DREAD factor considers how many users are impacted by a threat?

A Affected users

B Reproducibility

C Damage potential

D Discoverability

'Affected users' measures the number of users harmed if the threat happens.

Explain the STRIDE model and give a simple example for two of its categories.

Think about how attackers might pretend to be someone or block access to a service.

Describe how the DREAD model helps prioritize security threats.

Consider what makes some threats more urgent than others.

Practice

1. What is the main purpose of threat modeling in cybersecurity?

easy

A. To identify and prioritize potential security risks before they happen

B. To write code faster

C. To design user interfaces

D. To monitor network traffic in real-time

Solution

1. Step 1: Understand the goal of threat modeling

   Threat modeling is used to find security risks early in a system or application.

2. Step 2: Identify the main benefit

   It helps prioritize which risks to fix first to prevent harm.

3. Final Answer:

   To identify and prioritize potential security risks before they happen -> Option A

4. Quick Check:

   Threat modeling = find and rank risks [OK]

Hint: Threat modeling = find risks early and rank them [OK]

Common Mistakes:

• Confusing threat modeling with coding or UI design
• Thinking it monitors live traffic
• Assuming it fixes risks automatically

2. Which of the following correctly lists categories from the STRIDE threat model?

easy

A. Security, Trust, Reliability, Integrity, Data, Encryption

B. Scanning, Testing, Reporting, Investigating, Defending, Encrypting

C. Spoofing, Testing, Reporting, Information, Denial, Elevation

D. Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege

Solution

1. Step 1: Recall STRIDE categories

   STRIDE stands for Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege.

2. Step 2: Match options to STRIDE

   Only Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege lists all correct STRIDE categories in full.

3. Final Answer:

   Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege -> Option D

4. Quick Check:

   STRIDE = STRIDE categories [OK]

Hint: STRIDE is an acronym for six threat types [OK]

Common Mistakes:

• Mixing unrelated security terms
• Partial or incorrect category names
• Assuming STRIDE includes testing or encryption

3. Given a threat scored in DREAD as follows: Damage potential=3, Reproducibility=2, Exploitability=4, Affected users=3, Discoverability=1. What is the total DREAD score?

medium

A. 13

B. 12

C. 10

D. 9

Solution

1. Step 1: Add all DREAD components

   Sum the scores: 3 + 2 + 4 + 3 + 1 = 13.

2. Step 2: Verify calculation

   Check each value carefully to avoid mistakes.

3. Final Answer:

   13 -> Option A

4. Quick Check:

   Sum of DREAD scores = 13 [OK]

Hint: Add all five DREAD scores to get total [OK]

Common Mistakes:

• Forgetting one category in sum
• Adding incorrectly
• Confusing DREAD with STRIDE categories

4. A security analyst uses STRIDE but mistakenly includes 'Encryption' as a category. What is the error in this approach?

medium

A. Encryption is part of STRIDE under Denial of Service

B. Encryption is not a STRIDE threat category; it is a security control

C. Encryption is a DREAD scoring factor

D. Encryption is a type of Repudiation threat

Solution

1. Step 1: Understand STRIDE categories

   STRIDE categories are specific threat types, not security controls.

2. Step 2: Identify role of encryption

   Encryption is a defense method, not a threat category.

3. Final Answer:

   Encryption is not a STRIDE threat category; it is a security control -> Option B

4. Quick Check:

   Encryption = control, not STRIDE threat [OK]

Hint: STRIDE lists threats, not defenses like encryption [OK]

Common Mistakes:

• Confusing security controls with threat categories
• Mixing STRIDE and DREAD concepts
• Assuming encryption causes threats

5. You have two threats: Threat A with DREAD scores (Damage=5, Reproducibility=3, Exploitability=4, Affected Users=2, Discoverability=3) and Threat B with scores (Damage=4, Reproducibility=4, Exploitability=3, Affected Users=5, Discoverability=2). Which threat should be fixed first based on DREAD, and why?

hard

A. Threat B, because it has higher reproducibility

B. Threat A, because its total DREAD score is higher indicating greater risk

C. Threat B, because it has the higher total DREAD score indicating greater risk

D. Threat A, because it has higher damage potential only

Solution

1. Step 1: Calculate total DREAD scores for both threats

   Threat A: 5+3+4+2+3=17; Threat B: 4+4+3+5+2=18.

2. Step 2: Compare total scores and interpret

   Threat B has a higher total score (18) than Threat A (17), so Threat B is higher risk.

3. Step 3: Re-examine options carefully

   Threat A, because its total DREAD score is higher indicating greater risk incorrectly states Threat A has higher score. Options C and D focus on single factors instead of total score.

4. Final Answer:

   Threat B, because it has the higher total DREAD score indicating greater risk -> Option C

5. Quick Check:

   Total DREAD score guides priority [OK]

Hint: Sum DREAD scores; higher total means higher priority [OK]

Common Mistakes:

• Choosing based on one factor only
• Misadding scores
• Ignoring total DREAD score