Threat modeling is a structured process to identify cybersecurity threats and weaknesses in a system, with various methodologies to assess and prioritize these threats. The six main methodologies discussed are STRIDE, DREAD, PASTA, Trike, VAST, and OCTAVE, each with unique approaches to threat analysis and risk management. These frameworks help organizations identify assets, vulnerabilities, and design effective protection strategies.

1. 6 OF THE MOST
POPULAR
THREAT MODELING
METHODOLOGIES

2. What Is Threat Modeling?
Threat modeling is the structured process to identify
and enumerate potential cyber threats, like the defense
mechanisms or weaknesses in a system, and provide
security mitigations.

3. Steps to Make a Threat Model
Identify security objectives.
Identify the asset and external dependencies.
Identify trust zones.
1
3
2
Identify potential threats and weaknesses.
4
Document the threat.
5

4. Threat Modeling Methodologies
There are six common threat modeling methodologies
used by cybersecurity experts to access and prioritize
threats to IT assets. They are Vast, Stride, Trike,
Octave, Dread, and Pasta.

5. STRIDE
Stride is a threat model developed by Microsoft, and
it helps cybersecurity experts to categorize threats
into six classes. The classes are known as spoofing,
tampering, information disclosure, repudiation,
denial of service, and privilege escalation.

6. DREAD
Microsoft also created this threat model, and it is
used to determine the severity of a threat. It uses a
scale to rank threats into five categories. They are
damage potential, reproducibility, exploitability,
affected users, and discoverability.

7. PASTA
PASTA is an acronym for the Process for Attack
Simulation and Threat Analysis. PASTA offers a
risk-centric framework that offers a dynamic threat
scoring process. This threat model incorporates
business needs and technical requirements for
developing an asset-centric mitigation framework
to analyze threats from an attacker’s perspective.
Pasta comprises seven stages: Defining objectives, defining
the technical scope, application decomposition, threat
analysis, weaknesses analysis, attack modeling, and risk &
impact analysis.

8. TRIKE
Trike methodology follows a risk management,
defensive approach for threat modeling that
differentiates it from other threat modeling
methodologies. It is a systemic and systematic
evaluation of the security risks of a system by
examining all potential risks in the system.

9. VAST
The Visual, Agile, and Simple Threat modeling
methodology scales the threat modeling process
across the infrastructure for the entire software
development life cycle, integrating with agile and
DevOps practices. VAST is enterprise-focused and
provides actionable outputs for the different needs
of every stakeholder.

10. OCTAVE
The Operationally Critical Threat, Asset, and
Vulnerability Evaluation (OCTAVE) is a framework
for identifying and managing information security
risks. It starts with identifying the information on
assets that are critical to the organization, threats
to those assets, and the vulnerabilities that may
expose those assets to the threats. This helps the
organization design and implement a protection
strategy to reduce the overall risk exposure of its
information assets.

11. Thank You for
Watching!
Want to Become a Certified Threat Intelligence Analyst?​
Join our next batch for
Certified Threat Intelligence Analyst Program (CTIA)
from EC-Council