Threat Modeling with STRIDE and PASTA

Threat modeling is a structured process for identifying, prioritizing, and addressing security threats to a system before development or during design review. It answers: What are we building? What can go wrong? How do we fix it? How good is the result?

Threat model at design time (highest value, cheapest to fix), during major feature development, after architectural changes, and periodically for production systems. The cost to fix a design flaw found in threat modeling is 60x less than finding it in production.

STRIDE is a mnemonic threat classification framework developed at Microsoft. Each letter represents a threat category: Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege. Systematically apply STRIDE to each component in your architecture.

Spoofing: Can an attacker impersonate a legitimate user, service, or component? Mitigations: strong authentication, certificates. Tampering: Can an attacker modify data in transit or at rest? Mitigations: digital signatures, HMAC, integrity checks, TLS.

Repudiation: Can a user deny performing an action? Mitigation: audit logging, digital signatures. Information Disclosure: Can sensitive data be exposed? Mitigation: encryption, access control. Denial of Service: Can availability be disrupted? Mitigation: rate limiting, redundancy, input validation.

Can an attacker gain higher privileges than intended? Map all privilege levels in your system. Check: can a low-privilege user access admin functionality? Can a user process escape its sandbox? Each escalation path requires an access control mitigation.

Create a DFD showing processes, data stores, external entities, and data flows with trust boundaries marked. Each element and crossing of a trust boundary generates STRIDE threats. DFDs provide the systematic structure that prevents missed attack surfaces.

Process for Attack Simulation and Threat Analysis (PASTA) is a risk-centric threat modeling methodology with seven stages: define objectives, define technical scope, decompose application, analyze threats, identify vulnerabilities, enumerate attacks, and conduct risk analysis with countermeasures.

STRIDE is component-focused — systematically generating threats from a DFD. PASTA is risk-focused — starting from business objectives and working down to technical threats. STRIDE works well in development teams; PASTA aligns better with risk management and executive communication.

Attack trees decompose a root threat goal (e.g., "steal authentication token") into subtrees of alternative attack paths. Each leaf is a specific, concrete attack. Boolean logic (AND/OR) represents whether all or any sub-conditions must be true for the attack to succeed.

OWASP Threat Dragon is a free, open-source DFD-based threat modeling tool. Microsoft Threat Modeling Tool includes a STRIDE-based engine. IriusRisk and ThreatModeler are commercial options that integrate with Jira and CI/CD pipelines for continuous threat modeling.

Which STRIDE threat is mitigated by implementing strong audit logging and digital signatures?

Threat modeling with STRIDE systematically generates threats from data flow diagrams, while PASTA takes a risk-centric approach starting from business objectives. Both produce prioritized threat lists that guide security control selection before code is written or deployed.