MarcusEmma, let's talk about a scenario that comes up a lot. A company is building something new—say, a payment platform. They’ve run all the usual vulnerability scans, but the CISO says it’s not enough. They want a "proactive threat model." What does that mean? Why isn't a clean scan report good enough?
EmmaThat's a great question, because it gets to the heart of why these advanced techniques exist. A vulnerability scan is like checking the locks on all the doors and windows of a new building. It's essential, but it's reactive. It checks for known, existing flaws in the components you've used.
MarcusOkay, so it tells you if you used a faulty lock.
EmmaExactly. Threat modeling, on the other hand, is like standing with the architect before the foundation is even poured and asking, "What if an attacker tries to tunnel in from the building next door? What if they impersonate a delivery driver? What if they try to cut the power?" It's about finding flaws in the *design* itself, not just the implementation.
MarcusSo you're looking for ways the system can be abused, even if all the individual parts are secure. Where do we start with that? The source material mentions a few frameworks, starting with STRIDE.
EmmaSTRIDE is the perfect starting point. It’s a mnemonic developed by Microsoft, and it’s a way to systematically categorize threats. Think of it as a set of six different lenses you use to inspect your system design. Each lens helps you spot a different kind of threat.
MarcusOkay, let's look through those lenses. What's the 'S' in STRIDE?
Emma'S' is for Spoofing. This is about an attacker impersonating someone or something else. It's a violation of authentication. The classic example is a phishing email that looks like it's from your bank, trying to trick you into giving up your password.
MarcusSo, pretending to be a legitimate user or system. What about the 'T'?
Emma'T' is for Tampering. This is about unauthorized modification of data. It violates integrity. Imagine an attacker intercepting a bank transfer and changing the destination account number. They haven't stolen the information, they've altered it for their own benefit.
MarcusRight, changing the data in transit or at rest. Next up is 'R'.
Emma'R' is for Repudiation. This is when a user denies having performed an action, and the system has no way to prove they did. It's a violation of non-repudiation. For example, a user places a large stock trade and then, if the stock price drops, claims "I never made that trade!" Without strong logs, the firm can't prove it.
MarcusSo it's about being able to prove who did what, and when. What about the 'I' in STRIDE?
Emma'I' is Information Disclosure. This is a confidentiality breach—exposing information to someone who isn't authorized to see it. It could be a software bug that lets any user view another user's private files, or a server misconfiguration that exposes a customer database to the internet.
MarcusThat one’s pretty straightforward. The 'D'?
Emma'D' stands for Denial of Service. This is any attack that prevents legitimate users from accessing the system. It violates availability. The most common example is a DDoS attack that floods a website with so much traffic it crashes. But it could also be as simple as an attacker locking a user's account by intentionally failing the password attempt limit.
MarcusMaking the system unusable. And finally, the 'E'.
Emma'E' is for Elevation of Privilege. This is when a user with limited permissions—a regular user—finds a way to gain higher-level permissions, like becoming an administrator. It’s a violation of authorization. This is the goal of many attackers, because once they have admin rights, they can do almost anything.
MarcusSo, STRIDE gives us this comprehensive checklist to identify a whole range of potential threats. But that sounds like it could create a very long list. How do you decide what to fix first? You can’t tackle everything at once.
EmmaYou're exactly right. An unprioritized list of threats isn't very helpful. And that's where our next model, DREAD, comes in. If STRIDE is for finding the threats, DREAD is for ranking them.
MarcusOkay, another acronym. How does DREAD help us quantify the risk? Let's break it down. What's the first 'D'?
EmmaThe first 'D' is for Damage. Simply put, how bad would it be if this attack succeeded? We often score this on a scale, say 1 to 10. A catastrophic data breach would be a 10, while a minor inconvenience might be a 1 or 2.
MarcusMakes sense. What's the 'R'?
Emma'R' is for Reproducibility. How easy is it for the attacker to consistently repeat the attack? If it works every single time without fail, that's a 10. If it only works under a rare set of circumstances, it might be a 2.
MarcusOkay, so a reliable attack is more dangerous. Next is 'E'.
Emma'E' is Exploitability. This is about the skill and resources needed to launch the attack. Is it a simple script a novice could run? That's a 10. Does it require a team of nation-state hackers with millions in funding? That might be a 1.
MarcusGot it. And the 'A'?
Emma'A' is for Affected Users. How many people would be impacted by this attack? If it affects every single user of the platform, it's a 10. If it only affects a single, low-privilege account, it's a 1.
MarcusAnd the last 'D' in DREAD?
EmmaThat's Discoverability. How easy is it for an attacker to find this vulnerability in the first place? Is it listed on the front page of a hacker forum? That's a 10. Is it a deeply hidden, complex flaw that would require months of reverse-engineering to find? That would be a low score.
MarcusSo you score each threat across these five categories, add them up, and you get a risk rating. The threats with the highest scores are your top priorities.
EmmaPrecisely. It turns a subjective "this feels bad" into a semi-quantitative score that you can use to justify resource allocation and focus your efforts where they matter most.
MarcusWe have STRIDE to identify threats, and DREAD to rank them. There's a third technique mentioned: Attack Trees. Where do they fit in?
EmmaAttack Trees are for when you have a high-priority threat, maybe one that got a high DREAD score, and you need to understand it in much greater detail. They're a way to visualize all the possible paths an attacker could take to achieve a specific goal.
MarcusIt sounds like a flowchart for a crime.
EmmaThat's a perfect analogy. The goal of the attack, like "Steal Customer Data," is the root of the tree. Then you break that down into sub-goals, which are the branches. For example, to steal data, an attacker might need to "Compromise the Database Server" OR "Intercept Network Traffic."
MarcusYou said 'OR'. The source also mentions 'AND' nodes. What's the difference?
EmmaThe difference is crucial. An 'OR' node means the attacker has a choice of methods. They only need to succeed at one of the branches to achieve the parent goal. An 'AND' node means the attacker must complete all of the child steps. For instance, they might need to "Compromise User Credentials" AND "Bypass Multi-Factor Authentication." Both have to happen for that path to succeed.
MarcusSo Attack Trees let you map out complex, multi-stage attacks and see all the dependencies. Let's make this concrete. Can we walk through the worked example of the online banking module?
EmmaAbsolutely. First, we apply STRIDE to the design. We identify a major threat: "Unauthorized Funds Transfer." That falls under 'T' for Tampering, and maybe 'R' for Repudiation.
MarcusOkay, we've identified a big, scary threat. It would obviously get a high score in the 'Damage' part of DREAD. So we want to analyze it more deeply.
EmmaRight. So we build an Attack Tree. The root is "Unauthorized Funds Transfer." We brainstorm paths. One path might be an 'OR' branch: "Exploit an API Vulnerability." Another path might be an 'AND' combination: "Compromise User Credentials" AND "Bypass MFA."
MarcusAnd now we can apply DREAD to those specific, lower-level steps to see which path is more likely.
EmmaExactly. Let's take that "Compromise User Credentials" step. For DREAD, Damage is a 10—huge financial loss. Reproducibility? Phishing is common, so let's say a 7. Exploitability? Social engineering is very effective, so an 8. Affected Users? All customers, a 9. Discoverability? Phishing links are everywhere, so maybe a 6.
MarcusWhen you sum those up, you get a very high DREAD score.
EmmaAnd that high score tells the risk committee that this isn't a theoretical problem; it's a critical, probable attack path. That justifies prioritizing mitigations like enhanced MFA, better fraud detection, and more user education on phishing. You've connected a technical finding directly to a business risk and a clear action plan.
MarcusThis seems like a prime area for tricky exam questions. What are the common traps we should be watching for?
EmmaThe biggest one is confusing the purpose of STRIDE and DREAD. STRIDE is for *identification* and *categorization*. DREAD is for *quantification* and *prioritization*. If an exam question says threats have already been identified and asks for the *next* logical step to rank them, the answer is DREAD.
MarcusWhat's another common trap?
EmmaMisunderstanding the scope of Attack Trees. They are not a tool for broad, initial threat discovery. That's STRIDE's job. Attack Trees are a deep-dive tool for visualizing *how* a specific, complex attack could be executed. They analyze a known goal, they don't discover all possible goals.
MarcusAnd there’s almost always a question about who owns the risk. The risk manager does all this analysis, but who makes the final decision?
EmmaThis is fundamental for the CRISC exam. The IT risk practitioner identifies, analyzes, and presents the risk. But the ultimate responsibility for accepting or deciding how to treat that risk lies with the Business Process or Risk Owner. It's their budget, their process, and their accountability. The analyst advises; the business decides.
MarcusThat's a critical distinction. So let's quickly recap the main function of each. STRIDE is for...?
EmmaIdentifying and categorizing threats by security property.
MarcusAnd DREAD?
EmmaQuantifying and prioritizing those threats based on risk.
MarcusFinally, Attack Trees.
EmmaVisualizing the specific, step-by-step paths for a complex attack.
MarcusIt's clear that understanding the interplay between these models is key. Just reading about them isn't quite the same as working through scenarios.
EmmaYou're right, practice is essential. That's why VoraPrep is a full exam-prep app—it’s built around lessons, thousands of practice questions, and an AI tutor that lets you apply these concepts in realistic scenarios. You can get started and try it out at Vora Prep dot com.
MarcusSo, to bring it all home: You start broad with STRIDE to find out what *could* go wrong. You use DREAD to focus on what *matters* most. And you use Attack Trees to understand *how* the worst-case scenarios could actually happen.
EmmaThat's the flow. It’s a structured journey from a vague sense of worry to a prioritized, actionable list of risks that the business can understand and act on. And always remember, your analysis informs the business decision; it doesn't replace it.
MarcusFantastic. A clear framework for a complex topic. Thanks, Emma.
EmmaMy pleasure, Marcus. And thank you all for joining us for VoraPrep Audio. We’ll see you in the next Office Hours.