Threat modeling (STRIDE, DREAD) in Cybersecurity - Step-by-Step Execution

Concept Flow - Threat modeling (STRIDE, DREAD)

Identify Assets

↓

Identify Threats using STRIDE

↓

Assess Threats using DREAD

↓

Prioritize Threats

↓

Plan Mitigations

↓

Review and Update

The flow starts by identifying what to protect, then finds threats using STRIDE, assesses their risk with DREAD, prioritizes them, plans defenses, and repeats regularly.

Execution Sample

Cybersecurity

Assets = ['User Data', 'Server']
Threats = STRIDE(Assets)
Risks = DREAD(Threats)
Prioritize(Risks)
Mitigate(TopRisks)

This pseudocode shows identifying assets, finding threats with STRIDE, scoring risks with DREAD, prioritizing, and mitigating top risks.

Analysis Table

Step	Action	Details	Result
1	Identify Assets	List important things to protect	Assets = ['User Data', 'Server']
2	Apply STRIDE	Check each asset for Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege	Threats = ['Spoofing User Data', 'Tampering Server', ...]
3	Apply DREAD	Rate each threat on Damage, Reproducibility, Exploitability, Affected Users, Discoverability (scale 1-10)	Risks = {'Spoofing User Data': 35, 'Tampering Server': 40, ...}
4	Prioritize	Sort threats by DREAD score descending	TopRisks = ['Tampering Server', 'Spoofing User Data', ...]
5	Plan Mitigations	Decide how to reduce top risks	Mitigations planned for top threats
6	Review and Update	Repeat process regularly to catch new threats	Threat model updated

💡 Process ends after planning mitigations and scheduling reviews

State Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	After Step 4	Final
Assets	[]	['User Data', 'Server']	['User Data', 'Server']	['User Data', 'Server']	['User Data', 'Server']	['User Data', 'Server']
Threats	[]	[]	['Spoofing User Data', 'Tampering Server', 'Repudiation', 'Information Disclosure', 'Denial of Service', 'Elevation of Privilege']	['Spoofing User Data', 'Tampering Server', 'Repudiation', 'Information Disclosure', 'Denial of Service', 'Elevation of Privilege']	['Spoofing User Data', 'Tampering Server', 'Repudiation', 'Information Disclosure', 'Denial of Service', 'Elevation of Privilege']	['Spoofing User Data', 'Tampering Server', 'Repudiation', 'Information Disclosure', 'Denial of Service', 'Elevation of Privilege']
Risks	{}	{}	{}	{'Spoofing User Data': 35, 'Tampering Server': 40, 'Repudiation': 20, 'Information Disclosure': 30, 'Denial of Service': 25, 'Elevation of Privilege': 15}	{'Tampering Server': 40, 'Spoofing User Data': 35, 'Information Disclosure': 30, 'Denial of Service': 25, 'Repudiation': 20, 'Elevation of Privilege': 15}	{'Tampering Server': 40, 'Spoofing User Data': 35, 'Information Disclosure': 30, 'Denial of Service': 25, 'Repudiation': 20, 'Elevation of Privilege': 15}
TopRisks	[]	[]	[]	[]	['Tampering Server', 'Spoofing User Data', 'Information Disclosure', 'Denial of Service', 'Repudiation', 'Elevation of Privilege']	['Tampering Server', 'Spoofing User Data', 'Information Disclosure', 'Denial of Service', 'Repudiation', 'Elevation of Privilege']

Key Insights - 3 Insights

Why do we use STRIDE before DREAD?

STRIDE helps find different types of threats first (see execution_table step 2), then DREAD scores their risk (step 3). Without STRIDE, we might miss threats to score.

What does a high DREAD score mean?

A high DREAD score (execution_table step 3) means the threat is more dangerous or likely, so it should be prioritized for mitigation (step 4).

Why do we review and update the threat model regularly?

New threats appear over time. Regular review (step 6) keeps the model current and defenses effective.

Visual Quiz - 3 Questions

Look at the execution_table at step 3. What does the DREAD score represent?

A The risk level of each threat

B The number of assets

C The list of mitigations

D The types of threats

💡 Hint

Check the 'Details' and 'Result' columns at step 3 in execution_table

At which step in the execution_table do we decide which threats to fix first?

A Step 1

B Step 2

C Step 4

D Step 6

💡 Hint

Look for the step where threats are sorted by risk

If a new asset is added after step 1, how would the variable 'Threats' change?

A It would stay the same

B It would include threats related to the new asset

C It would remove old threats

D It would only list mitigations

💡 Hint

Refer to variable_tracker for how Threats depend on Assets

Concept Snapshot

Threat modeling helps find and fix security risks.
STRIDE finds threat types: Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege.
DREAD scores threats by Damage, Reproducibility, Exploitability, Affected users, Discoverability.
Use STRIDE first to identify threats, then DREAD to prioritize.
Plan mitigations for top risks and review regularly.

Full Transcript

Threat modeling is a process to find and fix security risks. First, identify what you want to protect, called assets. Then use STRIDE to find different types of threats to those assets. STRIDE stands for Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege. After listing threats, use DREAD to score each threat's risk. DREAD scores Damage potential, Reproducibility, Exploitability, Affected users, and Discoverability on a scale. Higher scores mean higher risk. Sort threats by their DREAD scores to decide which to fix first. Plan how to reduce these risks with mitigations. Finally, review and update the threat model regularly to catch new risks. This step-by-step process helps keep systems safer by focusing on the most serious threats first.

Practice

1. What is the main purpose of threat modeling in cybersecurity?

easy

A. To identify and prioritize potential security risks before they happen

B. To write code faster

C. To design user interfaces

D. To monitor network traffic in real-time

Solution

1. Step 1: Understand the goal of threat modeling

   Threat modeling is used to find security risks early in a system or application.

2. Step 2: Identify the main benefit

   It helps prioritize which risks to fix first to prevent harm.

3. Final Answer:

   To identify and prioritize potential security risks before they happen -> Option A

4. Quick Check:

   Threat modeling = find and rank risks [OK]

Hint: Threat modeling = find risks early and rank them [OK]

Common Mistakes:

• Confusing threat modeling with coding or UI design
• Thinking it monitors live traffic
• Assuming it fixes risks automatically

2. Which of the following correctly lists categories from the STRIDE threat model?

easy

A. Security, Trust, Reliability, Integrity, Data, Encryption

B. Scanning, Testing, Reporting, Investigating, Defending, Encrypting

C. Spoofing, Testing, Reporting, Information, Denial, Elevation

D. Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege

Solution

1. Step 1: Recall STRIDE categories

   STRIDE stands for Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege.

2. Step 2: Match options to STRIDE

   Only Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege lists all correct STRIDE categories in full.

3. Final Answer:

   Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege -> Option D

4. Quick Check:

   STRIDE = STRIDE categories [OK]

Hint: STRIDE is an acronym for six threat types [OK]

Common Mistakes:

• Mixing unrelated security terms
• Partial or incorrect category names
• Assuming STRIDE includes testing or encryption

3. Given a threat scored in DREAD as follows: Damage potential=3, Reproducibility=2, Exploitability=4, Affected users=3, Discoverability=1. What is the total DREAD score?

medium

A. 13

B. 12

C. 10

D. 9

Solution

1. Step 1: Add all DREAD components

   Sum the scores: 3 + 2 + 4 + 3 + 1 = 13.

2. Step 2: Verify calculation

   Check each value carefully to avoid mistakes.

3. Final Answer:

   13 -> Option A

4. Quick Check:

   Sum of DREAD scores = 13 [OK]

Hint: Add all five DREAD scores to get total [OK]

Common Mistakes:

• Forgetting one category in sum
• Adding incorrectly
• Confusing DREAD with STRIDE categories

4. A security analyst uses STRIDE but mistakenly includes 'Encryption' as a category. What is the error in this approach?

medium

A. Encryption is part of STRIDE under Denial of Service

B. Encryption is not a STRIDE threat category; it is a security control

C. Encryption is a DREAD scoring factor

D. Encryption is a type of Repudiation threat

Solution

1. Step 1: Understand STRIDE categories

   STRIDE categories are specific threat types, not security controls.

2. Step 2: Identify role of encryption

   Encryption is a defense method, not a threat category.

3. Final Answer:

   Encryption is not a STRIDE threat category; it is a security control -> Option B

4. Quick Check:

   Encryption = control, not STRIDE threat [OK]

Hint: STRIDE lists threats, not defenses like encryption [OK]

Common Mistakes:

• Confusing security controls with threat categories
• Mixing STRIDE and DREAD concepts
• Assuming encryption causes threats

5. You have two threats: Threat A with DREAD scores (Damage=5, Reproducibility=3, Exploitability=4, Affected Users=2, Discoverability=3) and Threat B with scores (Damage=4, Reproducibility=4, Exploitability=3, Affected Users=5, Discoverability=2). Which threat should be fixed first based on DREAD, and why?

hard

A. Threat B, because it has higher reproducibility

B. Threat A, because its total DREAD score is higher indicating greater risk

C. Threat B, because it has the higher total DREAD score indicating greater risk

D. Threat A, because it has higher damage potential only

Solution

1. Step 1: Calculate total DREAD scores for both threats

   Threat A: 5+3+4+2+3=17; Threat B: 4+4+3+5+2=18.

2. Step 2: Compare total scores and interpret

   Threat B has a higher total score (18) than Threat A (17), so Threat B is higher risk.

3. Step 3: Re-examine options carefully

   Threat A, because its total DREAD score is higher indicating greater risk incorrectly states Threat A has higher score. Options C and D focus on single factors instead of total score.

4. Final Answer:

   Threat B, because it has the higher total DREAD score indicating greater risk -> Option C

5. Quick Check:

   Total DREAD score guides priority [OK]

Hint: Sum DREAD scores; higher total means higher priority [OK]

Common Mistakes:

• Choosing based on one factor only
• Misadding scores
• Ignoring total DREAD score