Threat Modelling and Adversary Frameworks

All courses / Tools / Module 4 / Chapter 10

Learning objectives

After the lesson the participant can:

• Explain what STRIDE, ATT&CK, ATLAS and D3FEND each contribute to a threat model and the limit of each.
• Review a candidate threat against the seven soundness checks of AI Red Team.
• Draft a threat entry with a classification, an owned control and a verifying test.
• Rank techniques for a service on a priority list with stated reasons.

Key concepts

Working rule of the vocabularies

STRIDE names the harm at a boundary, ATT&CK and ATLAS name how an adversary produces it, and D3FEND names the class of countermeasure that answers it. ATT&CK itself does not say whether a technique is relevant to a service or whether a detection exists.

Threat model as code

A versioned file of kind ThreatModel that declares assets, trust boundaries, threats and linked controls, with reviewer decisions and a pointer to the test that verifies each threat. Three books define it with different schemas.

Soundness checks

Seven reviewer questions from AI Red Team, each with an automated part: grounding, classification, mitigation family, likelihood basis, impact basis, completeness and stability. Completeness flags a changed boundary that has no candidate threat.

Priority list

An artefact of AI Purple, family PRI: the 20 to 40 ATT&CK or ATLAS techniques that matter most for a service, each with tiers for impact, relevance and uncertainty from 1 to 3, an emulation route and the scenarios that test it.

Interactive exercises

Do them here and get feedback at once. Choose a card and then where it belongs, or drag it.

Teaching plan

Discussion

1. AI Purple calls the ATT&CK Navigator a sensible tool for planning and a poor tool for asserting. What does a coloured cell fail to tell a board?
2. Why does the series keep a rejected candidate threat in the model file with its reason instead of deleting it?
3. The OWASP lists describe observed weaknesses and so describe the past. How should a team use them without mistaking them for a complete threat model?

Written exercise

Self-test

Choose an answer to see whether it is right, or open the answer below each question.

1. Which failure does the completeness check catch that a reviewer reading only the candidate threats would never see?

   1. A threat whose likelihood cites no named assumption and no dated intelligence object
   2. A control that does not resolve to deployed configuration
   3. A boundary that changed in the pull request without any candidate threat
   4. A score that changed since the last accepted version of the model without a stated reason
   Show the answer

   C. A boundary that changed in the pull request without any candidate threat
   The completeness check asks whether every boundary changed in the pull request has threats considered; its automated part flags changed boundaries without candidates, a gap invisible to someone who reads only the candidates.

2. What limit does the series state for MITRE ATLAS when it is used in a threat model?

   1. It is young and still changing, so identifiers are pinned and checked against a named data release
   2. It names families of defence and not the organisation's own configuration
   3. It is costly and therefore reserved for a few high-value goals
   4. It names the harm at a boundary but not the route to it
   Show the answer

   A. It is young and still changing, so identifiers are pinned and checked against a named data release
   ATLAS is described by the originating book as young and still changing, so identifiers must be pinned. The other limits belong to D3FEND, attack trees and STRIDE respectively.

3. How are Mode 5 Autonomous production agents treated when a threat model is written?

   1. As trusted components whose actions need no scoring in the model at all
   2. As well-meaning insiders that can be manipulated, with permissions scored as if an adversary held them
   3. As external adversaries that are denied every permission by default in the design and are tested only in a separated range
   4. As conversational tools whose only modelled risk is a person misled by an answer
   Show the answer

   B. As well-meaning insiders that can be manipulated, with permissions scored as if an adversary held them
   The chapter states that Mode 5 agents are modelled as well-meaning insiders that can be manipulated or compromised, so their permissions are scored as if an adversary held them.