Threat modeling techniques

There are various threat modeling techniques and methodologies. STRIDE and DREAD are two of them. We will study the STRIDE and DREAD methodologies in the following sections.

STRIDE

STRIDE is an easy-to-use threat modeling methodology developed by Microsoft. STRIDE helps in identifying threats and is an abbreviation for the following terms:

• S—spoofing: Threats in the spoofing category include an adversary creating and exploiting confusion about the identity of someone or something.

For example, an adversary sends an email to a user pretending to be someone else.

• T—tampering: A tampering threat involves an adversary making modifications in data while in storage or in transit.

For...