Threat Modeling Frameworks & Quantitative Risk (STRIDE & DREAD)

Threat modeling is a structured engineering process designed to identify vulnerabilities, threat actors, and attack vectors before software systems are deployed to production. Without systematic threat modeling, security teams are forced into a reactive posture—scrambling to patch vulnerabilities discovered during production incidents or bug bounty reports.

In this lesson, we explore the industry's two most widely adopted threat evaluation frameworks: Microsoft's STRIDE model for identifying structural system flaws, and the DREAD framework for quantitatively prioritizing security vulnerabilities.

The STRIDE Threat Modeling Taxonomy#

Introduced by Loren Kohnfelder and Praerit Garg at Microsoft, the STRIDE mnemonic categorizes adversarial actions into six distinct threat classes, each representing the violation of a core security property:

+------------+-------------------------------+------------------------------+
| Threat     | Security Property Violated     | Classical Attack Example     |
+------------+-------------------------------+------------------------------+
| Spoofing   | Authenticity                  | IP / MAC / Session Hijacking |
| Tampering  | Integrity                     | SQL Parameter Modification   |
| Repudiation| Non-Repudiation (Audit Trail) | Deleting Log Files / Events  |
| Information| Confidentiality               | Packet Sniffing / S3 Leak    |
| Denial     | Availability                  | TCP SYN Flood / Fork Bomb    |
| Elevation  | Authorization                 | Kernel Buffer Overflow / sudo|
+------------+-------------------------------+------------------------------+

1. Spoofing (Violates Authenticity)#

An attacker pretends to be a legitimate user, process, or external system. Examples include forged JWT authentication tokens, email phishing (SMTP spoofing), and ARP cache poisoning.

• Mitigation: Cryptographic authentication (X.509 mutual TLS, signed JWTs with asymmetric keys, FIDO2 WebAuthn).

2. Tampering (Violates Integrity)#

An attacker modifies data at rest in storage or in transit across network boundaries without authorization. Examples include modifying query parameters in an e-commerce shopping cart to alter product prices, or altering operating system binaries.

• Mitigation: Cryptographic checksums (HMAC-SHA256), immutable storage, digital code signing, and TLS encryption.

3. Repudiation (Violates Non-Repudiation)#

An attacker or dishonest user performs an unauthorized action and successfully denies having performed it because the system lacks verifiable, tamper-evident audit logs.

• Mitigation: Append-only audit logging to centralized remote write-once storage (WORM), digital signatures, and forward-secure logging frameworks.

4. Information Disclosure (Violates Confidentiality)#

Sensitive data is exposed to unauthorized entities. Examples include unencrypted database backups, overly verbose API error stack traces leaking database schemas, and directory traversal vulnerabilities.

• Mitigation: End-to-end encryption (AES-256-GCM), database column-level encryption, sanitized error responses, and strict least-privilege IAM policies.

5. Denial of Service (Violates Availability)#

An adversary degrades or eliminates a service's ability to respond to legitimate users. Examples include algorithmic complexity attacks (ReDoS), distributed volumetric bandwidth floods, and memory exhaustion.

• Mitigation: Rate limiting, token bucket algorithms, autoscaling, caching layers (CDN), and SYN proxy filtering.

6. Elevation of Privilege (Violates Authorization)#

An adversary with restricted permissions gains access to higher-privileged capabilities or commands (e.g., escalating from a standard unprivileged user to root or system administrator).

• Mitigation: Principle of Least Privilege (PoLP), strict input validation, memory safety primitives, and capability-based access controls.

DREAD: Quantitative Risk Scoring#

Once threats are cataloged via STRIDE, security engineers prioritize remediation budgets using the DREAD quantitative scoring rubric. Each threat is graded from 1 to 10 across five criteria:

1. Damage Potential: How severe is the damage if the vulnerability is exploited? (1 = Minor informative leak; 10 = Complete infrastructure destruction or corporate bankruptcy).
2. Reproducibility: How reliably can an attacker reproduce the exploit? (1 = Rare timing race condition; 10 = Deterministic curl command that succeeds 100% of attempts).
3. Exploitability: What level of technical skill, tooling, and resources is required? (1 = Nation-state advanced exploit requiring customized zero-day chaining; 10 = Script kiddie tool downloadable on GitHub).
4. Affected Users: What percentage of users or systems are impacted? (1 = A single edge-case account; 10 = 100% of all global users and databases).
5. Discoverability: How easy is it for an attacker to find the flaw? (1 = Obscure internal legacy logic; 10 = Publicly visible HTTP GET endpoint with no authentication).

The composite DREAD Score is the arithmetic mean:

DREAD Score = (Damage + Reproducibility + Exploitability + Affected Users + Discoverability) / 5

Scores are classified into actionable triage tiers:

• High Risk (7.0 - 10.0): Critical vulnerability requiring immediate emergency patch deployment (P0).
• Medium Risk (4.0 - 6.9): Significant vulnerability scheduled into the immediate sprint cycle (P1).
• Low Risk (1.0 - 3.9): Minor finding logged into backlog for defense-in-depth hardening (P2).

Quantitative Financial Risk: The ALE Calculation#

In enterprise risk governance, quantitative financial modeling complements architectural scoring. The standard metric is the Annualized Loss Expectancy (ALE):

ALE = SLE × ARO
where:
Single Loss Expectancy (SLE) = Asset Value (AV) × Exposure Factor (EF)
Annualized Rate of Occurrence (ARO) = Estimated occurrences per calendar year

Practical Financial Example:

• An e-commerce company maintains a customer database valued at AV = 2,000,000 USD.
• A severe data breach would compromise 40% of the database records (Exposure Factor EF = 0.40).
• Historical industry telemetry suggests this class of breach occurs once every 5 years (ARO = 1 / 5 = 0.20).
• Single Loss Expectancy: SLE = 2,000,000 × 0.40 = 800,000 USD.
• Annualized Loss Expectancy: ALE = 800,000 × 0.20 = 160,000 USD/year.

If a proposed Web Application Firewall (WAF) and security monitoring solution costs 50,000 USD annually and eliminates 90% of this risk, the net annual cost-benefit is positive: (160,000 × 0.90) - 50,000 = 94,000 USD annual savings.

Hands-On Python Lab: Automated DREAD Calculator#

from typing import Dict

class ThreatAssessment:
    def __init__(self, name: str, damage: int, repro: int, exploit: int, users: int, discover: int):
        self.name = name
        self.scores = {
            "Damage": max(1, min(10, damage)),
            "Reproducibility": max(1, min(10, repro)),
            "Exploitability": max(1, min(10, exploit)),
            "Affected Users": max(1, min(10, users)),
            "Discoverability": max(1, min(10, discover))
        }

    def compute_score(self) -> float:
        total = sum(self.scores.values())
        return round(total / 5.0, 2)

    def severity_tier(self) -> str:
        score = self.compute_score()
        if score >= 7.0:
            return "CRITICAL (Emergency P0 Triage)"
        elif score >= 4.0:
            return "MEDIUM (Current Sprint Remediation)"
        else:
            return "LOW (Defensive Backlog)"

# Sample Evaluation
threats = [
    ThreatAssessment("Unauthenticated RCE in Admin API", damage=10, repro=10, exploit=9, users=10, discover=8),
    ThreatAssessment("Internal Server Info Leak in 404 Page", damage=2, repro=8, exploit=2, users=3, discover=9)
]

for t in threats:
    print(f"Threat: {t.name}")
    print(f"  Score: {t.compute_score()} / 10.0 -> Tier: {t.severity_tier()}")

Checkpoint Questions & Practice Exercises#

Question 1: An attacker discovers that an API endpoint allows them to view other users' private invoice documents simply by changing the invoice_id parameter in the URL. Which STRIDE category describes this threat, and what is the standard architectural fix?

• Answer: This is an Information Disclosure threat resulting from an Insecure Direct Object Reference (IDOR). The architectural fix is to enforce object-level authorization checks on the server side, ensuring that the authenticated user's session token has permission to access the requested resource.

Question 2: Calculate the Annualized Loss Expectancy (ALE) for an enterprise server farm valued at 500,000 USD with an exposure factor of 0.80 under a flood hazard that has an Annualized Rate of Occurrence (ARO) of 0.05.

• Answer: SLE = 500,000 × 0.80 = 400,000 USD. ALE = SLE × ARO = 400,000 × 0.05 = 20,000 USD per year.