Threat Modeling & Risk Assessment Flashcards

In the PASTA (Process for Attack Simulation and Threat Analysis) methodology, what is the primary focus of Stage 7?

Answer: Enumerate attack patterns and paths

Stage 7 of PASTA focuses on enumerating attack patterns and paths that can be exploited to reach the identified attack surface.

Which threat modeling approach is best suited when the team wants to think like an attacker and enumerate attack patterns first?

Answer: Attack-centric modeling

Attack-centric threat modeling starts from known attack patterns (e.g., CAPEC) to reason about how an adversary would compromise the system.

When assigning a DREAD score, the 'Affected Users' component is used to measure what?

Answer: The number or proportion of users impacted if the threat is realized

'Affected Users' in DREAD quantifies the breadth of impact — how many users would be harmed if the threat is successfully exploited.

A developer discovers that an unauthenticated API endpoint returns internal server version strings. Under STRIDE, which threat category best describes this?

Answer: Information Disclosure

Exposing internal version information to unauthenticated callers is an Information Disclosure threat, as it leaks data that aids attackers.

In a Data Flow Diagram (DFD) used for threat modeling, what does a double-lined rectangle symbol represent?

Answer: A data store

In DFDs, a double-lined rectangle (or parallel lines) represents a data store — a location where data is held at rest.

Which SDL activity ensures that threat model findings are re-evaluated after significant design changes late in development?

Answer: Threat model update

The SDL requires updating the threat model whenever the design, architecture, or data flows change significantly, ensuring findings remain accurate.

What is the primary purpose of establishing a 'bug bar' in Microsoft's SDL?

Answer: To define severity thresholds that determine whether a security bug must be fixed before release

The bug bar defines minimum security quality gates — bugs at or above a certain severity must be resolved before the product can ship.