To protect a network, you have to think like an attacker. Threat actors do not just rely on random exploits; they use repeatable strategies to compromise systems. Identifying how they might strike before a system is even built is a cornerstone of effective cybersecurity strategy, and that is exactly where threat modeling comes in.
Threat modeling enables security teams to systematically identify, categorize, and prioritize threats to a given asset. If you are preparing for elite certifications like the CISSP or CCSP, mastering these frameworks is not just recommended; it is absolutely required.
At Cert Empire, we provide the exact IT certification exam materials you need to master these concepts and pass your exams on the first attempt. To help you dominate the Risk Management domain, we are breaking down three of the most important threat modeling methodologies you need to know: STRIDE, PASTA, and DREAD.
What is Threat Modeling?
Before we dive into the specific methodologies, let’s establish the core objective. Threat modeling is a proactive exercise designed to answer four fundamental questions about your IT architecture:
- What are we building?
- What can go wrong?
- What are we going to do about it?
- Did we do a good enough job protecting it?
Because modern IT environments are vastly complex, doing this “off the top of your head” is impossible. Threat modeling methodologies provide the structured, systematic approaches needed to ensure no vulnerability slips through the cracks.
1. The STRIDE Model
Developed by Microsoft in the late 1990s to secure its software products, STRIDE is the most famous threat modeling methodology in the world. It is a quick, easy, and highly effective framework used to identify the types of threats a product or network is susceptible to during the design phase.
STRIDE is a mnemonic device. For certification exams like the CISSP, you must know what each letter stands for, and exactly which core security principle (from the CIA Triad + Non-repudiation) the threat violates.
The STRIDE Breakdown
| Threat (The Attack) | Definition | Security Property Violated |
| Spoofing | An attacker impersonates a user, device, or system to gain access (e.g., MAC spoofing, stolen credentials). | Authentication |
| Tampering | An attacker makes unauthorized changes to data at rest or data in transit. | Integrity |
| Repudiation | A user denies acting, and the system lacks the logging to prove otherwise. | Non-repudiation |
| Information Disclosure | The exposure of sensitive data to individuals who do not have authorized access (e.g., a data breach). | Confidentiality |
| Denial of Service (DoS) | An attacker floods a system with traffic to ensure authorized users cannot access the resource. | Availability |
| Elevation of Privilege | A user with limited access exploits a flaw to gain administrative or root-level access. | Authorization |
When to use STRIDE: Use STRIDE when you need a fast, developer-friendly way to systematically hunt for basic architectural flaws in software or network designs.
(Preparing for the CISSP? STRIDE is heavily tested. Check out our comprehensive exam simulators to test your knowledge against real-world exam scenarios).
2. The PASTA Model
If STRIDE is the “quick and easy” method, PASTA (Process for Attack Simulation and Threat Analysis) is the heavily detailed, enterprise-grade methodology.
Unlike STRIDE, PASTA is a risk-centric and attacker-focused model. It does not just look at technical flaws; it incorporates business objectives, financial impact, and governance. Because it aligns technical vulnerabilities with actual business risks, it is highly favored by Chief Information Security Officers (CISOs).
The 7 Stages of PASTA
PASTA forces security teams to view the application exactly how a hacker would. It is broken down into seven distinct, time-consuming, but highly valuable stages:
- Define Objectives: Identify the business goals of the application and conduct a Business Impact Analysis (BIA) to see what happens if the system fails.
- Define Technical Scope: Map out the exact boundaries of the system, including all hardware, software, and third-party dependencies.
- Application Decomposition: Break the system down into its smallest parts to expose every possible attack surface and data flow.
- Threat Analysis: Gather threat intelligence to determine who would actually want to attack this system (e.g., nation-states, script kiddies, insiders).
- Vulnerability and Flaws Analysis: Map the identified threats to known vulnerabilities (using resources like the CVE database or OWASP).
- Attack Modeling: Simulate the attacks. Build attack trees to map out exactly how a threat actor would string vulnerabilities together to breach the system.
- Risk and Impact Analysis: Calculate the financial and operational damage the attack would cause, and implement security controls to mitigate those specific risks.
When to use PASTA: Use PASTA for critical, high-value enterprise applications where you need to justify security budgets by linking technical vulnerabilities directly to financial business risks.
3. The DREAD Model
While STRIDE is used to identify threats, DREAD is used to prioritize them.
Once you have a massive list of potential vulnerabilities, you need to know which ones to fix first. DREAD gives you a mathematical rating system to rank the severity of a threat on a scale of 1 to 10 across five different categories.
The DREAD Breakdown
To calculate a DREAD score, you evaluate a threat based on the following:
- D – Damage Potential: If the exploit occurs, how bad is the damage? (1 = Nothing happens, 10 = Complete destruction of corporate data).
- R – Reproducibility: How easy is it to execute the attack again? (1 = Requires incredibly rare timing, 10 = Works every single time).
- E – Exploitability: How much skill and computing power is required? (1 = Requires a nation-state hacking group, 10 = A 12-year-old can do it via a web browser).
- A – Affected Users: How many people are impacted? (1 = A single low-level user, 10 = Every customer in the database).
- D – Discoverability: How easy is it for a hacker to find this vulnerability? (1 = Hidden deep in custom source code, 10 = Visible on the public login page).
How they work together: Security teams almost always pair STRIDE with DREAD. First, you use STRIDE to map out all the possible threats. Then, you run that list through the DREAD formula to figure out which vulnerabilities require immediate patching, and which ones can wait.
Master Threat Modeling and Advance Your Career
Understanding the nuances between STRIDE, PASTA, and DREAD is not just about passing an exam—it is about proving you have the architectural mindset required for high-level, high-paying cybersecurity roles.
Whether you are aiming for your CISSP, CCSP, or CISM, knowing how to identify and prioritize risk is the key to success. At Cert Empire, we provide the most accurate, up-to-date cybersecurity certification preparation materials available.
Equip yourself with our premium practice questions, master these methodologies, and walk into your exam completely prepared.
FAQS
1. What is threat modeling in cybersecurity?
Threat modeling is a proactive security process used to systematically identify, quantify, and prioritize potential threats and vulnerabilities in an IT system or application before it is deployed.
It helps security teams answer four critical questions during design:
- What are we building?
- What can go wrong?
- What are we going to do about it?
- Did we do a good enough job?
2. What is the difference between STRIDE, PASTA, and DREAD?
The main difference lies in their core focus: STRIDE is a developer-centric model used to identify technical security flaws; PASTA is a risk-centric, 7-step model focused on aligning threats with business impact; and DREAD is a quantitative scoring model used to prioritize identified vulnerabilities.
- STRIDE: Best for software design and developer-level threat categorization.
- PASTA: Best for enterprise risk management and C-suite decision-making.
- DREAD: Best for ranking vulnerabilities based on severity and ease of exploit.
3. What does STRIDE stand for in threat modeling?
In threat modeling, STRIDE is an acronym for six core categories of security threats:
- Spoofing (Violates Authentication)
- Tampering (Violates Integrity)
- Repudiation (Violates Non-Repudiation)
- Information Disclosure (Violates Confidentiality)
- Denial of Service (Violates Availability)
- Elevation of Privilege (Violates Authorization)
4. What are the 7 stages of the PASTA threat modeling framework?
The PASTA (Process for Attack Simulation and Threat Analysis) framework consists of 7 sequential, risk-centric stages:
- Define Objectives: Align business goals with security requirements.
- Define Technical Scope: Map out the boundaries of the system.
- Application Decomposition: Break down data flows and attack surfaces.
- Threat Analysis: Gather threat intelligence on potential actors.
- Vulnerability Analysis: Map threats to known system flaws (CVEs).
- Attack Modeling: Build attack trees to simulate exploitation.
- Risk and Impact Analysis: Calculate business impact and apply counter-measures.
5. How do you calculate a DREAD risk score?
A DREAD risk score is calculated by rating a threat from 1 to 10 across five categories and taking the mathematical average: (D + R + E + A + D) / 5.
The five categories are:
- Damage Potential: How severe is the impact?
- Reproducibility: How easy is it to repeat the attack?
- Exploitability: How much effort or skill is needed to exploit?
- Affected Users: How many users or systems will be impacted?
- Discoverability: How easy is it for an attacker to find the flaw?
6. Which threat modeling methodology is best?
There is no single “best” methodology; the best approach depends on your goal. STRIDE is best for quick software design reviews, PASTA is best for complex enterprise applications requiring business risk alignment, and DREAD is best when you need to mathematically prioritize a long list of bugs. Many organizations combine STRIDE (to find threats) with DREAD (to score them).
7. Why are STRIDE and DREAD commonly used together?
STRIDE and DREAD complement each other because STRIDE identifies threats, while DREAD prioritizes them. STRIDE outputs a comprehensive list of potential design vulnerabilities but does not tell you which one to fix first. Applying DREAD to your STRIDE results gives each threat a numerical risk score so engineering teams can focus on critical patches first.
8. What is the difference between threat modeling and risk assessment?
Threat modeling focuses on discovering specific technical flaws, attack vectors, and design weaknesses in a specific application or architecture. A risk assessment is a broader organizational process that evaluates the overall business impact, financial liability, regulatory compliance, and likelihood of security events across the entire enterprise.
9. Which threat modeling methodology is tested on the CISSP exam?
The STRIDE model is the most heavily tested threat modeling framework on the CISSP (and CCSP) exams under Domain 3 (Security Architecture and Engineering). Candidates are frequently tested on matching each letter of STRIDE to its corresponding element of the CIA Triad (e.g., Spoofing violates Authentication; Tampering violates Integrity).
10. At what phase of the SDLC should threat modeling be performed?
Threat modeling should be performed in the Design Phase of the Software Development Lifecycle (SDLC). Conducting threat modeling before any code is written allows security teams to catch architectural flaws early, making remediation significantly faster and up to 100 times less expensive than fixing vulnerabilities after deployment.
