Risk-Based Threat Modeling with PASTA

Risk-Centric Threat Modeling via Software

VerSprite’s Risk-Based PASTA Threat Model Incorporates Business Impact Analysis

PASTA – Process for Attack Simulation and Threat Analysis – is a risk-based threat model methodology that incorporates business impact analysis as an integral part of the process and expands cybersecurity responsibilities beyond the IT department.

This seven-step risk-based threat modeling process for risk analysis aims to align business objectives with technical requirements while considering business impact analysis and compliance requirements. The output provides threat management, threat enumeration, and scoring.

The PASTA threat modeling methodology combines an attacker-centric perspective on potential threats with business risk and threat impact analysis. The outputs are asset-centric. Also, the method’s risk and business impact analysis elevates threat modeling from a “software development only” exercise to a strategic business exercise by involving key decision-makers in the process.

This threat modeling methodology is geared towards organizations that wish to align threat modeling with strategic business objectives and centers around cyber threat mitigation as a business problem.

This guide is for:

• Security leaders building a risk-based application security program
• Product and engineering teams responsible for secure design
• GRC teams mapping technical threats to business impact
• Organizations moving beyond checklist-based threat modeling
• Teams evaluating PASTA, STRIDE, or enterprise threat modeling approaches