3.3 Threat Modeling: STRIDE, DREAD, and OCTAVE

PT0-003 lists three threat modeling frameworks under objective 1.3: STRIDE, DREAD, and OCTAVE. PTES even includes a dedicated threat-modeling phase, but PTES tells you when to threat-model in a pentest. These three tell you how to think about threats. They are not interchangeable. STRIDE labels a threat. DREAD scores it so you can rank work. OCTAVE starts from operationally critical assets inside the organization. If you only memorize the expansions, you will miss scenario items that ask which model to apply.

STRIDE: Qualitative Threat Categories

STRIDE originated at Microsoft as a design-time threat-classification model.

Property mapping

Each letter is a threat type, and each type maps to a security property you are trying to protect:

STRIDE is qualitative. You walk a data-flow or an attack path and ask, "which of these six can happen here?" A single finding often earns more than one letter: an unauthenticated command injection is commonly Elevation of privilege plus Tampering plus Information disclosure, and it may also enable Denial of service if the host can be crashed or encrypted.

On the exam, STRIDE is the answer when the stem wants you to categorize threats, run a design review, or name the type of attack a control is meant to stop. It is not a 0-to-10 formula and not an organizational workshop about which business asset is operationally critical.

DREAD: A Scoring and Ranking Model

DREAD is the quantitative-ish companion people confuse with STRIDE because both have Microsoft heritage. DREAD rates a specific finding so you can compare it with other findings:

• Damage potential — how bad is success (data loss, safety, ransomware, fraud)?
• Reproducibility — can you hit it every time, or only in a race?
• Exploitability — how much skill, access, or tooling does the attacker need?
• Affected users — one intern laptop, one plant, or every customer?
• Discoverability — would a skilled attacker find this without your notes?

Scoring 0-10

Each factor is commonly scored 0–10. Teams then average (or sometimes sum) the five numbers to produce a priority. DREAD is not a formal ISO standard and Microsoft moved away from it for product design, but it remains on the PT0-003 list because it teaches ranking. Two "high" STRIDE-labeled issues are not equal if one is a reliable unauthenticated RCE affecting all customers and the other is a local DoS on a lab VLAN.

DREAD is the answer when the stem wants you to score, rate, or prioritize a finding. It is the wrong answer when the stem wants threat categories (STRIDE) or an organizational asset workshop (OCTAVE).

Worked Example: One Finding, Two Models

Finding: an Internet-facing payments API accepts an unsanitized reportId parameter that yields command injection as www-data. A world-writable sudoers drop-in then elevates to root. The host can reach the cardholder database. Logs are local, rotatable by root, and not shipped to a SIEM.

STRIDE labels (what kind of threats are present):

• Spoofing — the API does not authenticate the caller before running reportId.
• Tampering — root on the payment host can alter settlement records.
• Repudiation — the attacker can wipe or rotate local logs, so actions may not be attributable.
• Information disclosure — cardholder data is reachable.
• Denial of service — the same access could crash or encrypt the host.
• Elevation of privilege — www-data to root via sudoers.

Those letters tell developers which properties failed. They do not, by themselves, tell the CISO whether to patch tonight or next quarter.

DREAD scores (how bad is this instance, 0–10):

Same evidence, two jobs: STRIDE names the threat types; DREAD produces a number you can rank against a stored XSS that scores a 4. If the DREAD damage and affected-user scores are this high on production, you also invoke the escalation path from the previous section — you do not wait for the closing meeting to mention ransomware-capable root.

OCTAVE: Organizational, Asset-Driven Risk

OCTAVE stands for Operationally Critical Threat, Asset, and Vulnerability Evaluation. It comes from CERT at Carnegie Mellon University's Software Engineering Institute (SEI), not from Microsoft. OCTAVE is a self-directed organizational risk assessment. It starts with what the business cannot afford to lose — operationally critical information assets and the processes around them — then evaluates threats and vulnerabilities in that operational context, and produces a security strategy the organization can own.

Later SEI work includes OCTAVE Allegro, a streamlined, information-asset-focused variant designed so a small team can finish an assessment without a huge consulting footprint. For PenTest+ you do not need to recite every Allegro worksheet. You need the contrast:

• OCTAVE asks, "which assets are operationally critical, and what would a threat to those assets do to the mission?"
• STRIDE asks, "which of six threat types apply to this component?"
• DREAD asks, "what score does this finding get so we know what to fix first?"

OCTAVE is not a pentest execution standard. It will not tell you how to exploit a sudoers file. It will tell a tester during pre-engagement that "payment processing" and "batch control for line 2" are the crown jewels, which is why those systems show up in the RoE and why a DREAD 7.8 on the payment API is not just another web finding. If an exam stem mentions operationally critical assets, organizational evaluation, or CERT/SEI, pick OCTAVE. If it mentions six threat categories, pick STRIDE. If it mentions damage, reproducibility, and a numeric rating, pick DREAD.

How the Three Fit an Engagement

Use OCTAVE-style thinking (or the client's existing BIA) to learn which assets are operationally critical before you spend hours on a low-value VLAN. Use STRIDE while reading architecture diagrams and data flows so you do not miss repudiation or spoofing just because the scanner is quiet. Use DREAD when you have too many confirmed findings and must decide what to exploit next and what to lead with in the executive summary.

Do not force one model to do the others' jobs. Scoring "Spoofing = 8" is not STRIDE. Holding a three-day asset workshop to classify a single XSS is not OCTAVE as CompTIA is using it. Listing DREAD letters without numbers is just a worse STRIDE. Match the framework to the question: label, score, or evaluate the organization.