Chapter 1 · Foundations·Advanced·~14 min

Threat Models

PASTA's seven-stage attacker-centric methodology, Cyber Kill Chain phases, the Diamond Model of intrusion analysis, and quantitative risk via factor analysis (FAIR).

You will learn

  • PASTA's seven stages and where it diverges from STRIDE
  • Lockheed's Cyber Kill Chain and its critics
  • The Diamond Model: adversary, infrastructure, capability, victim
  • FAIR for quantitative risk decomposition

PASTA: attacker-centric in seven stages

Process for Attack Simulation and Threat Analysis (UcedaVelez, 2015). Seven stages, each building on the prior:

  1. Define business objectives.
  2. Define the technical scope.
  3. Application decomposition (DFDs, asset enumeration).
  4. Threat analysis (using STRIDE, ATT&CK, threat intel).
  5. Vulnerability and weakness analysis (CWE catalog, code review).
  6. Attack simulation and modelling (attack trees from stage 4 against stage 5 weaknesses).
  7. Risk and impact analysis (against the business objectives from stage 1).

Different from STRIDE in being explicitly business-aligned and attacker-centric: starts from "what would the attacker want and how" rather than "what could go wrong with each component."

Cyber Kill Chain

Lockheed Martin's 2011 framework for intrusion analysis. Seven phases:

  1. Reconnaissance: harvesting target info.
  2. Weaponization: building a deliverable payload.
  3. Delivery: getting the payload to the target.
  4. Exploitation: triggering the vulnerability.
  5. Installation: establishing persistence.
  6. Command and control: opening the channel.
  7. Actions on objectives: the attacker's goal.

Defensive value: break the chain at any phase and the attack fails. Critics note it is too perimeter-focused (assumes attackers come in from outside), too linear (real attacks loop), and misses insider threats. The Unified Kill Chain (Pols, 2017) extends to 18 phases and addresses some of this.

The Diamond Model

Caltagirone, Pendergast, Betz (2013). Models every intrusion event as a diamond with four vertices:

  • Adversary: who is doing this.
  • Infrastructure: the tools and platforms they used (C2 IPs, domains, malware family).
  • Capability: the technique or exploit.
  • Victim: the target organization and asset.

Edges between vertices encode relationships ("adversary uses capability", "infrastructure attacks victim"). Knowing two vertices often lets you predict the others. The model is widely used in threat intel reports.

FAIR for quantitative risk

Factor Analysis of Information Risk. Decomposes "risk" into measurable factors:

  • Loss Event Frequency = Threat Event Frequency × Vulnerability.
  • Loss Magnitude = Primary Loss + Secondary Loss (legal, reputation, response).
  • Risk = LEF × LM, expressed as a distribution (range with confidence intervals), not a point.

Uses Monte Carlo simulation over the input distributions to produce loss-exceedance curves. The output: "there is a 10% chance we lose more than $X this year" rather than "risk is high". Useful for board-level conversations and for prioritizing investments by expected loss reduction per dollar spent.

Pragmatic frame selection

You do not need to pick one. Real organizations layer:

  • STRIDE for component design reviews.
  • ATT&CK for detection coverage and IR.
  • Cyber Kill Chain or Unified Kill Chain for incident narratives.
  • Diamond Model for threat intel reports.
  • FAIR for risk-quantification and prioritization.

The risk is methodology-as-religion. Pick what gets used; discard what does not.

Take the quizBack to intermediate