CompTIA Exam Prep - ITF+, A+, Network+, Security+, CySA+

STRIDE is a threat modeling framework — a structured way of asking "what could go wrong with this system?" before it is built, rather than discovering the answer afterwards. Developed at Microsoft in the late 1990s, it remains the most widely taught model of its kind. STRIDE works by turning each security property you want into the threat that violates it, then walking every component of the design against all six. That inversion is the useful part. Rather than asking the open-ended and unanswerable "how might this be attacked?", you ask six specific questions of every element, and the structure does the remembering for you. The Six Categories Threat Violates Meaning Primary defense S poofing Authentication Pretending to be someone or something else Strong authentication, MFA, certificates T ampering Integrity Unauthorized modification of data or code Hashing, digital signatures, access control R epudiation Non-repudiation Denying an action you performe...

DREAD is a scoring model for ranking threats, originally paired with STRIDE at Microsoft. STRIDE identifies what could go wrong; DREAD ranks what to fix first. It is worth knowing both because it still appears on exams and because the reasons it was abandoned teach something about risk scoring generally. The five categories Each is rated on a scale — commonly 1 to 10, sometimes 1 to 3 — and the ratings are combined. Damage — how bad is the outcome if this is exploited? Data destruction or full system compromise scores high; minor information disclosure scores low. Reproducibility — how reliably does the attack work? Something that works every time scores high; something requiring a narrow race condition scores low. Exploitability — how much skill, time and access does it take? A single unauthenticated request scores high; a chain requiring physical access and custom tooling scores low. Affected users — what proportion of users or systems ar...