Frameworks of Defense: A Quick Look at Key Threat Modeling Frameworks

 

What are threat modeling frameworks?

They are structured methodologies we can use to help us identify, categorize, and mitigate security risks in:

·       Systems

·       Applications

·       Data flows

From these frameworks we can build test plans to think like an attacker so that we can build defenses against them.

Key Frameworks

There are quite a few frameworks, but here are some key ones:       

DFD = Data Flow Diagram

Framework	Type / Focus	Key Idea	How It Works (Simplified)	Best Use Case
STRIDE	Threat identification model	Categorizes threats using a mnemonic	Six threat categories: Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege	Analyzing specific application components or features; commonly used with DFDs and tools like OWASP Juice Shop
PASTA (Process for Attack Simulation and Threat Analysis)	Risk-centric threat modeling framework	Connects technical threats to business impact	7 stages: 1) Business objectives  2) Technical scope 3) App decomposition (DFDs) 4) Threat analysis 5) Vulnerability analysis 6) Attack simulation  7) Risk/impact analysis	Enterprise assessments and communicating risk to executives or non-technical stakeholders
LINDDUN	Privacy threat modeling	STRIDE-like model, but focused on privacy risks	Categories:  Linkability,  Identifiability, Non-repudiation,  Detectability,  Disclosure,  Unawareness, Non-compliance	Systems handling personal data, privacy engineering, GDPR-related applications
DREAD	Risk scoring model (not threat discovery)	Assigns numerical risk scores to threats	Rates threats on Damage, Reproducibility, Exploitability, Affected users, Discoverability	Prioritizing threats once identified; mostly seen in legacy Microsoft documentation
MITRE ATT&CK	Adversary behavior knowledge base	Maps real attacker tactics and techniques	Large matrix of tactics (e.g., Persistence, Privilege Escalation) and techniques observed in real attacks	Red teaming, SOC detection engineering, mapping tests to known adversary behavior
TRIKE	Risk-based threat modeling	Define defensive requirements first, then identify threats violating them	Builds a risk model tied to system assets and acceptable risk levels	Systems requiring strict risk management and compliance alignment
OCTAVE (Operationally Critical Threat, Asset, and Vulnerability Evaluation)	Organizational risk framework	Focuses on protecting critical organizational assets	Evaluates assets, threats, and vulnerabilities through structured organizational assessment	Enterprise security strategy and organizational risk management
Attack Trees	Visual threat modeling technique	Hierarchical representation of attack goals	Root = attacker goal; branches = methods to achieve it	Modeling specific attack scenarios and attacker paths

How They Relate to Each Other

STRIDE    → What threats exist at each component?

PASTA     → What's the business risk of those threats?

DREAD     → How do we prioritize which threats to fix first?

MITRE ATT&CK    → How do real attackers actually execute those threats?

LINDDUN   → Are we also protecting privacy, not just security?

Attack Trees → What attack paths exist?

TRIKE → What risks violate our security requirements?

OCTAVE → Which critical assets are at risk and how do organizational practices affect them?

For application security and pentesting, the most relevant are:

Priority	Framework	Why It Matters
⭐⭐⭐	STRIDE	Most widely taught application threat modeling approach
⭐⭐⭐	MITRE ATT&CK	Industry standard for mapping attacker techniques
⭐⭐	Attack Trees	Useful for visualizing attacker paths
⭐⭐	PASTA	Good for risk-based enterprise modeling
⭐	LINDDUN	Important if privacy/data protection is involved

I wanted to give a quick overview of frameworks because I am trying to map my QA background to threat modeling. I will be covering this in my next blog post where I explore STRIDE.

Additional Threat Modeling Frameworks Worth Knowing

BONUS! Here are a few additional frameworks / methodologies professionals use. 

Framework	Type / Focus	Key Idea	Best Use Case
VAST (Visual, Agile, and Simple Threat Modeling)	Scalable threat modeling for DevOps	Designed for large organizations and automated pipelines	Enterprises integrating threat modeling into Agile/DevSecOps workflows
CVSS (Common Vulnerability Scoring System)	Vulnerability scoring model	Standardized numerical score for vulnerability severity	Prioritizing vulnerability remediation; widely used in vulnerability management
NIST Risk Management Framework (RMF)	Government risk framework	Structured lifecycle for managing security risk	U.S. government and regulated industries
Kill Chain Model	Attack lifecycle model	Describes stages of a cyberattack from recon to exfiltration	Threat detection strategy and defensive planning
Cyber Threat Modeling Language (CTML)	Structured modeling approach	Formal language for defining threats and mitigations	More academic or architecture-heavy environments