Threat Modeling: STRIDE and PASTA Methodologies

Threat modeling identifies vulnerabilities before attackers do.

STRIDE Model

S - Spoofing identity
T - Tampering with data
R - Repudiation
I - Information disclosure
D - Denial of service
E - Elevation of privilege

PASTA (7 Steps)

1. Define objectives
2. Define technical scope
3. Application decomposition
4. Threat analysis
5. Vulnerability analysis
6. Attack modeling
7. Risk and impact analysis

Tools

- Microsoft Threat Modeling Tool
- OWASP Threat Dragon
- IriusRisk
- ThreatModeler