DREAD Threat Modeling: An Introduction to Qualitative Risk Analysis

DREAD Threat Modeling: An Introduction to Qualitative Risk Analysis By 2025, the global cost of cybercrime is projected to reach an estimated $10.5 trillion (INTRUSION, Inc., 2020). With 30,000 websites hacked every day (Bulao, 2022), companies of all sizes need to prioritize cybersecurity. As the prevalence and costs of cybercrime skyrocket, organizations have developed a variety of methods to model cyberthreats and assess cybersecurity risks and vulnerabilities. One of these risk analysis methodologies is DREAD, a threat modeling framework created by Microsoft (Meier et al., 2003). Although Microsoft has since abandoned the model, citing concerns about its subjectivity (Shostack, 2008), it’s still in use today by small businesses, Fortune 500 companies, and the military. What Is the DREAD Model? The DREAD model quantitatively assesses the severity of a cyberthreat using a scaled rating system that assigns numerical values to risk categories. The DREAD model has five categories (Meier et al., 2003): Damage: Understand the potential damage a particular threat is capable of causing. Reproducibility: Identify how easy it is to replicate an attack. Exploitability: Analyze the system’s vulnerabilities to ascertain susceptibility to cyberattacks. Affected Users: Calculate ho