STRIDE, PASTA, DREAD, and Attack Trees: Threat Modeling the Way CISSP Tests It

Threat modeling is the point in a design where someone finally asks how it will be attacked. ISC2 puts it at objective 1.10 of Domain 1, next to risk management, because it is a risk activity performed on a design rather than an organization. The exam tests it with names: STRIDE, PASTA, DREAD, attack trees, data flow diagrams. Candidates who memorize the acronyms still miss the questions, because each method exists to answer a different question, and the scenario is really asking which.

Threat modeling is a design activity

A vulnerability assessment finds flaws in something that exists. Threat modeling finds them in something that is being designed, which makes it the cheapest security work an organization ever does: the fix is a change to a diagram rather than a change to a product. The exam frames it that way. When a scenario asks when threat modeling should occur, the answer is during design, and repeated whenever the design changes materially.

Three orientations organize every method in the objective, and the exam names two of them explicitly.

• Attacker-centric modeling starts from the adversary: who would attack this, what are they capable of, what do they want? It produces attack scenarios and attack trees.
• Asset-centric modeling starts from what is valuable: which assets matter most, and how could each be compromised? It produces prioritized protection requirements.
• Software-centric (or system-centric) modeling starts from the design itself: decompose the system, draw its data flows, and enumerate what could go wrong at each point. It produces STRIDE-style findings against a data flow diagram.

A scenario that begins with an adversary profile wants an attacker-centric answer. One that begins with a crown-jewels inventory wants asset-centric. One that hands you an architecture diagram wants software-centric, which is where STRIDE lives.

STRIDE: six threats, six properties

STRIDE is a checklist for asking "what could go wrong here" at every element of a design, and its power on the exam is that each threat maps to exactly one property it violates. Know the mapping cold; it is the single most tested fact in the objective.

Two rows trip candidates. Repudiation is not a confidentiality problem; it is the absence of proof, and its counter is logging and digital signatures. Elevation of privilege breaks authorization, not authentication: the attacker is already someone, and now they are someone with more rights. If the stem describes an attacker impersonating a legitimate user, that is spoofing; if it describes a legitimate user doing something above their role, that is elevation.

Data flow diagrams and trust boundaries

STRIDE is applied to something, and that something is a data flow diagram. The elements are processes, data stores, external entities and the flows between them, and the annotation that matters is the trust boundary: the line where data crosses from one level of trust to another. The internet to your web tier is a trust boundary. The web tier to the database is another. A user's browser to your API is another.

The exam's point is that threats cluster at boundaries. Data crossing a trust boundary should be validated on arrival, authenticated if its origin matters, and encrypted if the boundary is a network. A scenario that hands you a diagram and asks where to focus is asking you to find the boundaries.

PASTA: seven stages, from business to attack

PASTA is the heavyweight in the objective. Where STRIDE is a checklist, PASTA is a methodology, and its distinguishing feature is that it starts with the business rather than the system.

1. Define the objectives: what the business needs from the system, and what compliance requires.
2. Define the technical scope: the components, dependencies and boundaries in play.
3. Decompose the application: data flows, trust boundaries, entry points, roles.
4. Analyze the threats: which threat actors and threat scenarios are relevant to this business and this design.
5. Analyze the vulnerabilities: which weaknesses in the decomposition those threats could exploit.
6. Model the attacks: attack trees and simulations of how the threats would actually proceed.
7. Analyze risk and impact: what the attacks would cost, and which countermeasures are worth it.

The exam rarely asks you to recite all seven. It asks what makes PASTA different: it is risk-centric and business-aligned, so it ends with a prioritized set of countermeasures justified in business terms rather than a list of findings. A scenario describing an organization that wants threat modeling output executives can act on is describing PASTA.

DREAD: turning a threat into a number

DREAD answers the question STRIDE leaves open: of everything we found, what do we fix first? It scores each threat on five factors.

The scores are combined into a ranking. The exam's angle is that DREAD is qualitative and subjective: two reviewers will score the same threat differently, which is the main criticism of it and the reason many organizations replaced it with likelihood-and-impact matrices or CVSS-style scoring. If a stem describes inconsistent threat rankings across teams, it is describing DREAD's known weakness.

Attack trees: the attacker's plan as a diagram

An attack tree puts the goal at the root and the ways to reach it as branches. OR nodes mean any child achieves the parent; AND nodes mean all children are needed. Leaves can be annotated with cost, probability or required skill, and then the cheapest path to the root is the one to defend first.

The exam's use of attack trees is usually about the gates. A scenario where an attack requires three things to succeed is an AND node, and the defensive insight is that you only have to make one of them impractical. A scenario with three independent ways in is an OR node, and you have to address all three. Attack trees are the natural output of attacker-centric modeling, and they are what PASTA's sixth stage produces.

Four stems, routed

1. An architect presents a diagram of a new payment service with the internet, a web tier, an API tier and a database, and asks where to focus the review. Software-centric, and the answer is the trust boundaries: internet to web, web to API, API to database. Apply STRIDE at each crossing.
2. A threat intelligence team reports that a specific criminal group is targeting the company's sector with a known toolkit. Attacker-centric. Build attack trees from that group's capabilities against your assets, and find the AND gates.
3. Two product teams ranked the same finding as critical and low, and leadership wants to know which is right. Neither is wrong; the method is. DREAD's subjectivity is the problem, and a shared rubric with defined scoring criteria, or a quantitative approach, is the fix.
4. The board wants threat modeling output that justifies spending in business terms. PASTA, because it starts from business objectives and ends with countermeasures ranked by impact.

Where candidates lose marks

• STRIDE finds, DREAD ranks, PASTA runs the whole process. They are not alternatives; a question asking for a way to prioritize STRIDE findings wants DREAD or a risk matrix.
• Threat modeling is not penetration testing. It happens on a design, before code, and it finds classes of weakness rather than specific exploitable bugs. Testing validates the model later, in Domain 6.
• Trust boundaries are where the work is. A question about where to concentrate analysis on a diagram is answered by the boundaries, not by the biggest box.
• PASTA's first stage is business objectives. Any answer that starts PASTA with decomposition or attack simulation has the order wrong.
• DREAD's weakness is subjectivity. Its scores depend on who is scoring, which is why the exam presents inconsistency as its symptom.

Threat modeling is objective 1.10 of CISSP Domain 1, the largest domain at 16%, and it feeds the risk vocabulary of objective 1.9 and the security models that Domain 3 builds on. Work all 60 topics across twelve objectives with our CISSP Domain 1 study guide.

#CISSP #ISC2 #ThreatModeling #STRIDE #PASTA #DREAD #AttackTrees #SecurityArchitecture #InfoSec #CyberSecurity