Threat modeling is one of the most-tested skills on the CompTIA SecurityX exam and one of the most-mishandled skills in actual practice. The two most cited methods, STRIDE and PASTA, are tools, not religions. Knowing when to use either, and when to use neither, is the architectural skill the exam rewards.
STRIDE: the per-component check
STRIDE is a categorization aid. Walk through every component or data flow in a system and ask: could this be subject to Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, or Elevation of privilege?
STRIDE works best for systems with a stable architecture diagram and a defined trust boundary. It is fast, it is checkable, and a junior team member can drive it under supervision. It struggles with systems that change quickly or with attacker motivations that do not map cleanly to the six categories.
PASTA: the risk-driven walk
PASTA, Process for Attack Simulation and Threat Analysis, is heavier. It starts with business objectives, identifies threats relevant to those objectives, decomposes the application, enumerates attacker capabilities, simulates attacks, and ends with risk-prioritized findings.
PASTA produces deeper analysis than STRIDE. It also takes longer, requires more senior input, and benefits from a security architect who can hold the business context in mind while walking the technical decomposition. Reserve PASTA for systems where the cost of a compromise is high enough to justify a multi-day analysis.
The lightweight alternative
For fast-moving engineering teams, both STRIDE and PASTA can be overweight. A lighter method that often works better: walk the architecture diagram and answer four questions per component.
What can an attacker do here? What stops them today? Where does that control fail? What would we add to harden it?
This four-question pass produces actionable findings in under an hour for most components. It does not give you the STRIDE matrix or the PASTA risk register, but it produces engineering work the team will actually do. For CI/CD-paced shops, that is usually more valuable.
What CAS-005 expects you to know
The exam asks you to read a scenario, identify threats, and recommend controls. STRIDE shows up directly in question wording. PASTA is referenced but less commonly drilled. The exam also rewards judgment: when a question describes a small, fast-moving team, the correct answer is usually the lighter analysis, not the heaviest one available.
Leave a Reply