Evaluating Threat Modeling Methodologies

In today's increasingly digital world, cybersecurity has become an essential component of any organization's risk management strategy. Threat modeling is a key technique used by cybersecurity professionals to identify, prioritize, and mitigate potential threats and vulnerabilities in their systems and applications. There are various threat modeling methodologies used in the industry, but three of the most commonly used are STRIDE, DREAD, and PASTA. In this article, we will discuss the differences between these methodologies and their respective strengths and weaknesses.

STRIDE 

STRIDE stands for Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, and Elevation of privilege. This methodology was developed by Microsoft and is focused on identifying and prioritizing threats based on these six categories. The strength of STRIDE is that it provides a simple and easy-to-understand framework that can be used to identify a broad range of threats. The weakness of STRIDE is that it can lead to a long list of potential threats, some of which may not be relevant to the specific system or application being analyzed. It rarely incorporates organizational context to those threats. STRIDE is best applied when a security team is looking to identify and categorize potential threats in a structured and consistent way. It is particularly useful for identifying threats that may not be immediately apparent, as it provides a comprehensive framework for evaluating potential vulnerabilities. One advantage of using STRIDE is that it can help ensure all potential threats are considered rather than relying on ad hoc analysis or a haphazard approach. Additionally, using a standardized framework can make it easier to communicate potential risks to stakeholders, such as developers, testers, and business analysts. 

DREAD 

DREAD stands for Damage potential, Reproducibility, Exploitability, Affected users, and Discoverability. Microsoft also developed this methodology and is typically applied during the design phase of the software development lifecycle to evaluate and prioritize potential threats to a system or application. However, it can also be used during other phases, such as testing and maintenance, to evaluate new threats or changes to the system. The strength of DREAD is that it provides a more comprehensive analysis of potential threats than STRIDE. The weakness of DREAD is that it can be time-consuming to evaluate each category, and some categories may not be relevant to the specific system or application being analyzed. In general, DREAD is best applied when a security team is looking to evaluate the potential impact of a threat in a systematic and repeatable way. It can be particularly useful in situations where there are limited resources available to address security concerns, as it helps to prioritize the most critical issues. 

PASTA 

PASTA stands for Process for Attack Simulation and Threat Analysis. This methodology was the creation of Tony Uceda Velez and Marco Morana. It takes a more risk-centric approach, simulating realistic attack scenarios to identify potential threats. The strength of PASTA is that it provides a more comprehensive and realistic analysis of potential threats by simulating how attackers may attempt to exploit vulnerabilities in a system or application. The weakness of PASTA is that it can be more complex and time-consuming than other methodologies, and it requires a high level of expertise to implement effectively. Opposite its counterparts, PASTA is typically applied during the later stages of the software development lifecycle, after the system or application has been developed and is close to being deployed. It can also be used in a continuous monitoring fashion to evaluate changes to the system. PASTA is best applied when a security team is looking to evaluate the effectiveness of the security controls for a system or application. It is particularly useful for identifying vulnerabilities that may not be apparent through other means, as it uses a combination of attack simulation and vulnerability analysis to evaluate the system's defenses. One advantage of using PASTA is that it provides a comprehensive and realistic view of the system's security posture based on actual attacks and simulations. Additionally, PASTA can help identify gaps in the security controls, allowing security teams to prioritize remediation efforts based on the most critical threats. 

Conclusion 

All three threat modeling methodologies have their respective strengths and weaknesses. STRIDE provides a simple and easy-to-understand framework for identifying potential threats but can lead to a long list of irrelevant threats. DREAD provides a more comprehensive analysis of potential threats but can be time-consuming to evaluate each category. PASTA provides a more realistic analysis of potential threats but can be complex and time-consuming to implement effectively. The choice of threat modeling methodology ultimately depends on the specific needs of an organization and the level of resources and expertise available. It is important to carefully evaluate each methodology and choose the best fit for the organization's needs.

About the author: Maril Vernon is a Senior Application Security Architect supporting the CMS Threat Modeling Team