MODULE 2 — Threat Models and Risk Assessment
Learning Objectives
By the end of this module, learners will be able to:
- Define threat, vulnerability, exploit, and risk.
- Apply formal threat-modelling frameworks.
- Identify adversary categories and capability levels.
- Construct asset-centric and attacker-centric models.
- Evaluate risks using quantitative and qualitative methods.
- Prioritise security controls based on risk impact.
Module Overview
Threat modelling is the analytical backbone of cybersecurity engineering. While the CIA Triad defines what must be protected, threat modelling defines who we are defending against and how they might attack.
This module explores structured frameworks such as STRIDE, Kill Chain, and ATT&CK to analyse adversarial behaviour. We also examine classical risk methodologies: likelihood-impact matrices, quantitative risk scoring, and engineering-informed probabilistic reasoning.
1. Foundations of Threat Modelling
1.1 What is a Threat?
A threat is the potential for an event—malicious or accidental—to cause harm to assets.
1.2 Key Components
- Assets — data, systems, infrastructure
- Adversaries — attackers with motives and capabilities
- Attack vectors — pathways for compromise
- Vulnerabilities — weaknesses enabling exploitation
1.3 Why Threat Modelling Matters
Threat modelling enables organisations to:
- Predict likely attacks
- Reduce blind spots
- Allocate resources efficiently
- Design proactive defences
2. Adversary Categories
2.1 Script Kiddies
Low skill, relying on pre-built tools.
2.2 Cybercriminals
Moderate to high sophistication, financially motivated.
2.3 State-Sponsored Groups
Advanced Persistent Threats (APTs) with long-term objectives.
2.4 Insider Threats
Employees or contractors with privileged access.
2.5 Hacktivists
Motivated by ideology; unpredictable but persistent.
Each adversary type has distinct tactics, resources, and persistence profiles.
3. Threat Modelling Frameworks
3.1 STRIDE
Maps threats to:
- Spoofing
- Tampering
- Repudiation
- Information Disclosure
- Denial of Service
- Elevation of Privilege
3.2 Cyber Kill Chain
A linear progression model describing attacker behaviour from reconnaissance → actions on objective.
3.3 MITRE ATT&CK
A granular matrix of real-world adversary tactics and techniques.
3.4 Attack Trees
Hierarchical models representing attacker decision pathways.
4. Risk Assessment
4.1 Defining Risk
Risk = Likelihood × Impact
4.2 Qualitative Methods
- Red-Amber-Green scoring
- Likelihood-impact matrices
4.3 Quantitative Methods
- Annualized Loss Expectancy (ALE)
- Monte Carlo modelling
- Probabilistic risk analysis
4.4 Prioritisation
Controls should target:
- High likelihood + high impact threats
- Low likelihood + catastrophic impact scenarios
5. Practical Exercises
- Build a STRIDE analysis for a web login system.
- Construct an attack tree targeting an IoT device.
- Perform a likelihood/impact evaluation for three threats.
- Map a recent breach to the MITRE ATT&CK framework.
6. Reflection Questions
- Which adversary type poses the greatest risk in your industry?
- Why do organisations often underestimate insider threats?
- How would you justify increased budget using risk assessment?
Summary
Threat models allow cybersecurity professionals to anticipate attacks before they occur. Risk assessment transforms abstract threats into actionable engineering priorities.
Readings
- NIST Risk Management Framework
- ENISA Threat Landscape Reports
- MITRE ATT&CK Knowledge Base