thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Application & OT Security · Intermediate

Process for Attack Simulation and Threat Analysis (PASTA)

A seven-stage, risk-centric threat modeling methodology that aligns technical threats with business objectives.

Definition

PASTA's stages are: define objectives, define technical scope, application decomposition, threat analysis, vulnerability and weakness analysis, attack modeling, and risk and impact analysis. It uses threat intelligence and attack trees to estimate business impact. It is heavier than STRIDE and suits risk-driven organizations.

Example

A bank uses PASTA to tie a payment API threat to regulatory and fraud-loss impact.

Exam tip

PASTA is risk-centric with seven stages; STRIDE is threat-category-centric.

Related terms