Threat Modeling, Concepts, Methodologies

Question 1

Threat Focus

Answer 1

Focused on assets
Focused on attackers
Focuses on software

Question 2

STRIDE

Answer 2

Spoofing
Tampering
Repudiation
Information disclosure
Denial of Service (DoS)
Elevation of privilege

Question 3

PASTA - Process for Attack Simulation and Threat Analysis (7 Stages)

Answer 3

1. Definition of the Objectives (for analysis of risk)
2. Definition of Technical Scope
3. Application Decomposition and analysis
4. Threat analysis
5. Weakness and vulnerability analysis
6. Attack Modeling & Simulation
7. Risk analysis & Management

Question 4

Trike

Answer 4

risk based approach instead of depending upon aggregated threat model use in STRIDE and DREAD; performing security audit in reliable + repeatable way

Question 5

DREAD stands for:

Answer 5

Disaster, Reproducibility, Exploitability, Affected Users, Discoverability

Question 6

VAST stands for:

Answer 6

Visual, Agile and Simple Threat;
Based on agile project management and programming;
scalable