Overview
Chapter 4 covers the Architecture (A2) phase of the Security Development Lifecycle (SDL) — the most
complex phase, where security is analyzed at a structural level. It focuses on threat modeling, risk
assessment, and defining security architecture before code is written. This phase is led by senior
software security architects who must "think like an adversary."
Key topics
Core frameworks and methodologies
STRIDE — Threat categorization
Popularized by Microsoft. Each letter classifies an attacker's goal. Applied per DFD component.
S — Spoofing (→ Authentication) T — Tampering (→ Integrity) R — Repudiation (→ Nonrepudiation) I —
Information disclosure (→ Confidentiality) D — Denial of service (→ Availability) E — Elevation of
privilege (→ Authorization)
DREAD — Risk scoring model
Microsoft model. Scores each threat 0–10 across 5 dimensions, then averages them.
D — Damage potential R — Reproducibility E — Exploitability A — Affected users D — Discoverability
Risk_DREAD = (D + R + E + A + D) / 5 → Low: 5–7 | Medium: 8–11 | High: 12–15
Risk formulas
Risk = Probability × Damage Potential
Risk = Likelihood × Impact (Generic Risk Model)
Other methodologies covered
PASTA (7-step, 2011) Trike (automated, risk-based) CVSS (post-release scoring) OCTAVE (org-level risk)
AS/NZS ISO 31000:2009 (business risk standard) Web App Security Frame (ASF)
Key terms and definitions
Data Flow Diagram (DFD)
Visual representation showing how data moves through a system. Hierarchical in structure. Used as the
foundation of threat modeling. Focuses on data flow, not code flow.
Trust boundary
A line in a DFD separating areas with different privilege levels or trust assumptions. Every crossing of a
trust boundary is a potential attack surface.
Attack surface
The sum of all entry points through which an attacker could try to enter or extract data from a system.
The goal of the A2 phase is to minimize this.
Attack tree
A hierarchical diagram showing how an attacker could achieve a goal. Used in combination with attack
patterns for deeper threat analysis and test plan creation.
PASTA
Process for Attack Simulation and Threat Analysis. A 7-step platform-agnostic methodology that aligns
business objectives with technical security requirements, including compliance and business impact.
Trike
A risk-based threat modeling methodology with distinct implementation, threat, and risk models.
Distinguished by high automation, a defensive perspective, and formal methodology. Available on
SourceForge.
CVSS
Common Vulnerability Scoring System. A post-release vulnerability severity scoring standard maintained
by FIRST. Uses base, temporal, and environmental metrics. Not a threat modeling tool.
OCTAVE
Operationally Critical Threat, Asset, and Vulnerability Evaluation. From Carnegie Mellon SEI. Focuses on
organizational (not technical) risk. Three variants: OCTAVE, OCTAVE-S, and OCTAVE-Allegro.
Privacy Impact Assessment (PIA)
An analysis of how personally identifiable information (PII) is collected, handled, and protected
throughout the system. Begins during the A2 phase.
Security profile
A document created during threat analysis that identifies design and implementation approaches for
input validation, authentication, authorization, configuration management, and other vulnerability-
prone areas.
CIA Triad
Confidentiality, Integrity, and Availability — the three core security properties used to define business
requirements and classify threats in the SDL.
Least privilege
A security design principle: processes and users are granted only the minimum permissions needed to
perform their function.
Defense in depth
A layered security strategy in which multiple independent controls protect assets so that no single point
of failure compromises the entire system.
ThreatModeler
A commercial tool that supports the PASTA methodology using mind-mapping. Allows organizations to
scale threat modeling across thousands of applications and centrally manage threat categories and risk
attributes.
Threat analysis areas (Security Profile)
Ten categories examined during architectural threat analysis:
Input validation Authentication Authorization Configuration management Sensitive data Session
management Cryptography Exception management Parameter manipulation Auditing and logging
Risk mitigation strategies
After ranking threats, organizations choose one of 5 options:
Do nothing
Hope for the best
Inform users
Warn about the risk
Mitigate the risk
Apply countermeasures
Accept the risk
After evaluating business impact
Transfer the risk
Insurance or contracts