Principles of Information Security: Threat Modeling (STRIDE, DREAD)

Threat Modeling (STRIDE, DREAD)

Threat Modeling (STRIDE, DREAD) – Exam-Ready Study Guide

What This Is

Threat modeling is a structured way to identify, prioritize, and mitigate security threats before they become incidents. It helps teams think like attackers to find weaknesses in systems, applications, or processes. A real-world example: The 2017 Equifax breach (147M records exposed) happened because an unpatched Apache Struts vulnerability (CVE-2017-5638) wasn’t addressed—threat modeling could have flagged this as a high-risk remote code execution (RCE) threat under STRIDE’s "Elevation of Privilege" category.

Key Terms & Concepts

• Threat Modeling: A proactive process to identify and mitigate security threats by analyzing system design, data flows, and attacker motivations. Frameworks: STRIDE, DREAD, PASTA, OCTAVE.
• STRIDE: A Microsoft-developed mnemonic for 6 threat categories (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege). Used in CISSP, CEH, and Secure SDLC.
• DREAD: A risk-rating model (Damage, Reproducibility, Exploitability, Affected Users, Discoverability) to prioritize threats. Scores range from 0–10 (higher = worse).
• Data Flow Diagram (DFD): A visual tool (e.g., Microsoft Threat Modeling Tool, OWASP Threat Dragon) to map how data moves through a system, helping identify attack surfaces.
• Attack Surface: All possible entry points an attacker could exploit (e.g., APIs, user inputs, network ports). NIST SP 800-160 emphasizes minimizing this.
• Threat Agent: An entity (human or automated) that exploits vulnerabilities (e.g., hackers, insiders, malware). MITRE ATT&CK catalogs their tactics.
• Risk = Threat × Vulnerability × Impact: The core formula for prioritizing threats. ISO 27005 and NIST RMF use this.
• Mitigation Strategy: Actions to reduce risk (e.g., input validation for Tampering, MFA for Spoofing, rate limiting for DoS).
• OWASP Top 10: A list of critical web app risks (e.g., Injection, Broken Authentication) that align with STRIDE threats.
• Zero Trust: A security model assuming breach; threat modeling helps enforce least privilege and micro-segmentation (NIST SP 800-207).

Step-by-Step / Process Flow

1. Define Scope & Assets

• Identify the system, application, or process to model (e.g., a banking app, cloud storage).
• List critical assets (e.g., customer PII, payment data, admin credentials).
• Tool: Use a DFD (Data Flow Diagram) to visualize components and trust boundaries.

2. Decompose the System

• Break the system into components (e.g., frontend, backend, database, APIs).
• Map data flows (e.g., user → login page → auth server → database).
• Example: In a web app, highlight where user input enters the system (common attack vector).

3. Apply STRIDE to Identify Threats

For each component/data flow, ask: "Could this be exploited for...?"
| STRIDE Threat | Definition | Example | Mitigation |
|-------------------|-----------------------------|--------------------------------------|------------------------------------|
| Spoofing | Impersonating a user/device | Phishing to steal credentials | MFA, certificate-based auth |
| Tampering | Modifying data in transit | SQL injection to alter database | Input validation, WAF |
| Repudiation | Denying an action | User claims they didn’t transfer funds | Digital signatures, audit logs |
| Info Disclosure | Exposing sensitive data | Misconfigured S3 bucket leaking PII | Encryption (TLS, AES), access controls |
| DoS | Disrupting service | SYN flood attack | Rate limiting, DDoS protection |
| EoP | Gaining higher privileges | Exploiting a buffer overflow | Least privilege, patch management |

4. Rate Threats with DREAD

Score each threat (0–10) across 5 categories, then average:
- Damage: How bad is the impact? (10 = catastrophic)
- Reproducibility: How easy is it to reproduce? (10 = trivial)
- Exploitability: How easy is it to exploit? (10 = script kiddie)
- Affected Users: How many are impacted? (10 = all users)
- Discoverability: How easy is it to find? (10 = public exploit)

Example: A SQL injection in a login page might score:
- Damage: 8 (data theft), Reproducibility: 7, Exploitability: 6, Affected Users: 9, Discoverability: 5 → Average = 7 (High Risk).

5. Prioritize & Mitigate

• Focus on high DREAD scores first.
• Apply OWASP Top 10 or NIST SP 800-53 controls (e.g., AC-3 for access control).
• Tools: Microsoft Threat Modeling Tool, OWASP ZAP, Burp Suite for validation.

6. Document & Reassess

• Record threats, scores, and mitigations in a threat model report.
• Revisit the model quarterly or after major changes (e.g., new features, breaches).

Common Mistakes

• Mistake: Confusing threats with vulnerabilities.

• Correction: A threat is a potential attack (e.g., phishing), while a vulnerability is a weakness (e.g., lack of MFA). STRIDE identifies threats; CVSS scores vulnerabilities.

• Mistake: Skipping the DFD and jumping straight to STRIDE.

• Correction: Without a DFD, you’ll miss trust boundaries (e.g., where data crosses from public to private networks).

• Mistake: Using DREAD subjectively (e.g., scoring "Damage" as 10 for every threat).

• Correction: Use objective criteria (e.g., "Damage = 10 if >1M records exposed or $10M loss").

• Mistake: Ignoring non-technical threats (e.g., social engineering).

• Correction: STRIDE’s Spoofing and Repudiation cover human factors (e.g., phishing, insider threats).

• Mistake: Treating threat modeling as a one-time activity.

• Correction: It’s iterative—update the model after patches, new features, or incidents.

Certification Exam Tips

• CISSP: Expect management-level questions (e.g., "Which STRIDE threat is mitigated by digital signatures?" → Repudiation). Focus on risk prioritization (DREAD) and NIST RMF integration.
• Security+: Know STRIDE definitions and DREAD scoring (e.g., "Which DREAD factor measures how many users are affected?" → Affected Users). Common trap: Mixing up Tampering (data modification) and Information Disclosure (data exposure).
• CEH: STRIDE is used in penetration testing (e.g., "Which STRIDE threat applies to a buffer overflow exploit?" → Elevation of Privilege). Memorize OWASP Top 10 mappings to STRIDE.
• ⚠️ Exam Trap: Questions may ask for the "best" mitigation—pick the most specific control (e.g., WAF for Tampering, not just "firewall").

Quick Check Questions

1. A developer is designing a new e-commerce checkout system. During threat modeling, they identify that an attacker could modify the price of an item in transit between the browser and server. Which STRIDE threat does this represent?
2. A) Spoofing
3. B) Tampering
4. C) Repudiation
5. D) Information Disclosure
6. Answer: B) Tampering

7. Explanation: Tampering involves unauthorized modification of data (e.g., altering prices, SQL injection).

8. A security team uses DREAD to prioritize threats. A vulnerability in their VPN server could allow an attacker to crash the service, affecting all 10,000 employees. The exploit is publicly available, but requires moderate skill. How would you score "Exploitability" and "Affected Users"?

9. A) Exploitability = 3, Affected Users = 5
10. B) Exploitability = 6, Affected Users = 10
11. C) Exploitability = 8, Affected Users = 7
12. D) Exploitability = 10, Affected Users = 10
13. Answer: B) Exploitability = 6, Affected Users = 10

14. Explanation: "Exploitability = 6" (moderate skill), "Affected Users = 10" (all employees).

15. Which of the following is the BEST mitigation for a "Repudiation" threat in a financial transaction system?

16. A) Encrypting data at rest
17. B) Implementing multi-factor authentication
18. C) Using digital signatures for transaction logs
19. D) Rate limiting API requests
20. Answer: C) Using digital signatures for transaction logs
21. Explanation: Repudiation threats involve denying actions (e.g., "I didn’t transfer that money"). Digital signatures provide non-repudiation.

Last-Minute Cram Sheet

1. STRIDE: Spoofing, Tampering, Repudiation, Information Disclosure, DoS, Elevation of Privilege.
2. DREAD: Damage, Reproducibility, Exploitability, Affected Users, Discoverability (score 0–10).
3. DFD: Data Flow Diagram – maps trust boundaries and attack surfaces.
4. STRIDE → OWASP Top 10: Injection = Tampering, Broken Auth = Spoofing, Sensitive Data Exposure = Info Disclosure.
5. DREAD High Risk: Average score ≥7 (prioritize mitigation).
6. ⚠️ Exam Trap: "Repudiation" ≠ "Spoofing" – Repudiation is about denying actions, not impersonation.
7. Mitigation for Spoofing: MFA, certificate-based auth.
8. Mitigation for Tampering: Input validation, WAF, hashing.
9. Mitigation for DoS: Rate limiting, DDoS protection (e.g., Cloudflare).
10. Threat Modeling Tools: Microsoft Threat Modeling Tool, OWASP Threat Dragon, Burp Suite.