1. What threat modeling does
Threat modeling is a structured way to identify what can go wrong in a system, estimate the significance of those threats, and choose controls before an attacker turns a design weakness into an incident.
Learning objectives
By the end of this lab, a student should be able to distinguish major threat-modeling approaches, apply STRIDE to system components and data flows, use DREAD-like numerical scoring, construct an attack tree, and write abuse and misuse cases that lead to concrete security requirements.
Tutorial → system model → STRIDE → scoring → process models → attack tree → abuse/misuse cases → quiz.
2. Framework quick reference
STRIDE Enumeration
Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege.
Best for systematic identification of threat categories across components, identities, processes, stores, and flows.
DREAD Scoring
Damage, Reproducibility, Exploitability, Affected users, Discoverability.
Useful pedagogically for understanding risk scoring. Many teams now prefer likelihood/impact matrices or organizational risk models because DREAD scoring can be subjective.
PASTA Risk-centric
Process for Attack Simulation and Threat Analysis. A staged methodology that ties business objectives to technical attack analysis.
VAST Scale
Visual, Agile, and Simple Threat modeling. Emphasizes scalable modeling for development and operational perspectives.
Trike Risk management
Focuses on actors, assets, allowed actions, requirements, threats, and explicit risk management decisions.
Attack Trees Adversary path
Represent an attacker goal as a tree of possible sub-goals and techniques using AND/OR decomposition.
Abuse Cases Attacker stories
Describe how a malicious or negligent actor could misuse system functionality to harm an asset or stakeholder.
Misuse Cases Negative use cases
Describe undesirable interactions the system must prevent, often paired directly with security requirements and countermeasures.
3. System model: University Research Portal
Use the following fictional system throughout the lab. It stores research papers, grant documents, intellectual property, student records, and unpublished experimental data.
4. STRIDE threat enumeration lab
Select a component, choose a STRIDE category, and describe one plausible threat. The tool will suggest typical security properties and mitigations.
Threat register
5. DREAD scoring exercise
Move each slider from 1 to 10. The average is shown as a simple comparative score. This is a learning aid, not a substitute for a formally calibrated organizational risk model.
6. PASTA guided walkthrough
PASTA connects business context to attack simulation. Work through each stage and record one short observation.
7. VAST modeling exercise
VAST commonly separates application-focused modeling from operational/infrastructure modeling. Classify each issue into the perspective that best fits it.
Application model examples
Operational model examples
8. Trike-style actor / asset / action matrix
Decide whether an actor should be allowed to perform an action on an asset. Then identify the threat if that authorization rule is violated.
9. Interactive attack tree
Goal: Exfiltrate unpublished research data. Add attacker paths. Use OR branches for alternative ways to achieve a goal and AND branches when multiple conditions are required.
10. Abuse cases and misuse cases
Abuse case builder
Misuse-to-requirement translator
11. Compare the approaches
| Method | Primary purpose | Strongest use | Common limitation |
|---|---|---|---|
| STRIDE | Threat enumeration | Systematic category coverage | Does not itself quantify business risk |
| DREAD | Relative scoring | Teaching and comparative prioritization | Subjective scores; inconsistent calibration |
| PASTA | Risk-centric process | Connecting business impact to technical attack analysis | More process-heavy than lightweight workshops |
| VAST | Scalable organizational modeling | Agile/DevSecOps scale and application + operational views | May require tooling/process integration for enterprise scale |
| Trike | Risk management and authorization analysis | Actor/asset/action reasoning and explicit acceptable risk | Less commonly encountered than STRIDE in many organizations |
| Attack tree | Adversary path decomposition | Exploring alternate attack routes and required conditions | Can grow rapidly and become difficult to maintain |
| Abuse case | Adversarial narrative | Security requirements from attacker behavior | Coverage depends heavily on analyst creativity |
| Misuse case | Negative system interaction | Linking unwanted behavior to countermeasures | Can become anecdotal without systematic enumeration |
12. Student knowledge check
13. Instructor challenge
Ask students to repeat the exercise for one of these systems:
PHI, identity, availability, ransomware, insider access.
Source code, CI/CD, containers, build integrity, secrets, software supply chain.
Credential theft, API abuse, fraudulent transactions, device compromise.
Student deliverable: one diagram, one STRIDE table, one prioritized threat list, one attack tree, two abuse/misuse cases, and at least five mitigations mapped to threats.
14. Suggested references
For further study, consult Microsoft threat-modeling guidance, OWASP Threat Modeling, NIST risk-management publications, MITRE ATT&CK, and your organization’s secure software development and risk-management standards. This lab intentionally teaches concepts rather than locking students into a single proprietary modeling tool.