Threat modeling is a structured process to identify security requirements, detect potential threats, and quantify vulnerability severity early in development.
1. The STRIDE Model
STRIDE classifies threats into six distinct security areas:
- Spoofing: Pretending to be someone else.
- Tampering: Unauthorized modifications to data.
- Repudiation: Claiming an action was not performed.
- Information Disclosure: Leaking private data.
- Denial of Service: Blocking access to resources.
- Elevation of Privilege: Gaining unauthorized administrative access.
2. DREAD Rating Scale
DREAD calculates risk score using five categories: Damage, Reproducibility, Exploitability, Affected Users, and Discoverability.