Other Methodologies: DREAD, VAST and Attack Trees

Besides STRIDE and PASTA, there are other useful methodologies depending on the specific context of the analysis. DREAD is a scoring system, not a threat identification method in itself, that rates each threat already found on five criteria (damage potential, reproducibility, exploitability, affected users and discoverability), producing a numerical score that helps prioritize among multiple threats when the team needs to decide where to start with limited resources. VAST, which stands for Visual, Agile and Simple Threat modeling, is designed specifically to scale in large organizations with many teams working in parallel under agile methodologies, separating the analysis into two types of models, one for applications and one for operations, so each team can maintain its own model without depending on a centralized process that becomes a bottleneck. Attack trees offer a different visual representation, placing an attacker's final objective at the root and breaking down beneath it the different possible paths to achieve it, which is particularly useful for clearly and visually communicating to non-technical audiences how different individual weaknesses can combine into a complete attack chain toward a specific critical objective.