Senior LevelWeb Security & Cyber Defense
How do you perform Enterprise Threat Modeling using STRIDE and DREAD frameworks?
❓ Interview Prompt: Explain Threat Modeling, STRIDE threat categories, DREAD risk scoring, Data Flow Diagrams (DFD), and mitigating architectural flaws.
Threat Modeling is a structured engineering process for identifying, quantifying, and mitigating security flaws early in software architecture design:
STRIDE Threat Model:
•
Spoofing Identity (Authentication defenses required).
•
Tampering with Data (Integrity defenses required).
•
Repudiation (Audit logging defenses required).
•
Information Disclosure (Confidentiality & encryption required).
•
Denial of Service (Rate limiting & availability required).
•
Elevation of Privilege (Authorization PoLP required).
DREAD Risk Scoring:
Scores risk from 1-10 based on: $\text{Risk} = (\text{Damage} + \text{Reproducibility} + \text{Exploitability} + \text{Affected Users} + \text{Discoverability}) / 5$.
Code Implementation Example
json
{
"threatModel": {
"component": "Payment Gateway API",
"strideCategory": "Tampering",
"description": "Attacker modifies transaction amount in request body",
"dreadScore": 8.4,
"mitigation": "HMAC payload signature verification & server-side price lookup"
}
}💡STRIDE threat model assessment and DREAD risk score payload.
🎯 Interview Key Takeaway
Execute STRIDE threat modeling during architectural design to catch security flaws before writing code.
#Threat Modeling#STRIDE#DREAD#Architecture#Senior
Back to all Web Security & Cyber Defense Questions→