thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Commonly confused · Application & OT Security

STRIDE vs DREAD: Threat Modeling Compared

STRIDE is a Microsoft threat classification model used to identify threats by category: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, and Elevation of privilege. DREAD is a risk rating model that scores identified threats on Damage, Reproducibility, Exploitability, Affected users, and Discoverability.

STRIDEDREAD
PurposeIdentify and categorize threatsRate and prioritize threats
OutputList of threats per componentNumeric risk score
StageEarly design, data flow diagramsAfter threats are identified
MappingEach category maps to a violated property (authenticity, integrity, non-repudiation, confidentiality, availability, authorization)Each factor scored, often 1-10, then averaged
Current useWidely usedLargely retired at Microsoft due to subjectivity
Remember it

STRIDE finds the threats; DREAD ranks them.

Exam tip

Know each STRIDE letter and its violated property. A question asking which model scores threats is DREAD; one asking which categorizes them is STRIDE.

Tested on

More Application & OT Security look-alikes