Threat Modeling Methodologies

Learn how threat modeling and associated methodologies can improve the evaluation of cybersecurity threats, and provide actionable countermeasures.

Show me the methodologies

How to choose the right threat modeling methodology for your organization

Organizations are increasingly aware of the pressing need to bring threat modeling into their cyber security operations. In doing so, businesses can identify, understand and manage the threats they face, protecting them from the evolving threat landscape.

However, while organizations are conscious of the need to threat model, it can be daunting to know where to begin. This is in part due to the range of threat modeling methodologies that companies can make use of, as each is a unique approach and provides varied benefits.

Among these, the most common are STRIDE, OCTAVE, TRIKE AND PASTA. We will unpack these methodologies and how to assess which is right for your organization.

STRIDE: useful for analyzing systems and networks if adopters have a strong understanding of their threats.
OCTAVE: takes an operational approach as opposed to technological. Great for risk-focused teams.
TRIKE: open source approach based upon defense outlooks and techniques.
PASTA: a scalable option for collaboration across technical and compliance teams, to consider the probability of attacks.

Threat Modeling methodologies... Explained

STRIDE

STRIDE (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service and Elevation of Privilege) is a popular methodology, originally developed by Microsoft. STRIDE is designed to focus on the identification of specific types of threats and vulnerabilities. The advantage of STRIDE is that it allows organizations to analyze systems and networks, classifying threats in a prioritized list, based on the likelihood of them occurring and the scale of their potential impact.

Read more about STRIDE below. Including some pros and cons.

OCTAVE®

OCTAVE (Operationally Critical Threat, Asset and Vulnerabilities Evaluation), developed by the Carnegie Mellon Software Engineering Institute, is a risk-based methodology. This methodology focuses more on organizational risks than technological risks, for example, a company could experience a data breach and this would have an impact on a company’s operational capabilities.

OCTAVE employs a self directed approach, and thus employees are responsible for setting the overall security strategy - typically Management and Operations rather than Technical teams. This can make this difficult to scale and as such this methodology is aimed at small to medium sized organizations.

Labout OCTAVE and its other variations, including OCTAVE-S and OCTAVE Allegro.

TRIKE

TRIKE, unlike the previous two methodologies, is an open source threat modeling process designed to tackle the security auditing process from a risk management and defense perspective.

The TRIKE approach is risk-based, assigning a level of risk for each asset and guaranteeing this is acceptable to its stakeholders. Take a look at TRIKE in more depth.

PASTA

PASTA aims to bring together the objectives of an organization, but also its technical requirements. As such this method creates cross-team collaboration, involving both technical teams and key decision makers. This means that with PASTA both compliance and regulatory needs are met, as well as the technical scope and potential vulnerabilities.
‍
The Process of Attack Simulation and Threat Analysis (PASTA) was created by VerSprite CEO Tony UcedaVélez and security leader Marco M. Morana. This risk-centric methodology uses a seven step process for risk analysis: define objectives, define technical scope, application decomposition, threat analysis, vulnerability and weakness analysis, attack modeling and risk and impact analysis.

No methodology? Perhaps you are unsure if you even need one.

Finding the right threat modeling methodology requires a thorough assessment of an organization's needs. This can range from the size of business, the type of business and the potential risks it faces, as well as who within the organization will need to understand and operate it.

By following these steps and implementing the right methodology, whether it be STRIDE, OCTAVE, PASTA, TRIKE, or none at all, companies can continue with normal business operations, feeling confident that their assets are secure.

‍If you’re interested in understanding what threat modeling methodology will work best for your organization, get in touch with the IriusRisk team here.

Talk To Us