Measuring Risk and Security

Security isn’t just about identifying threats—it’s about quantifying, assessing, and mitigating risks effectively. This chapter explores how frameworks like STRIDE and DREAD help measure security risks, assess their impact, and prioritize mitigation efforts.

1. Quantifying Security Risks Using STRIDE & DREAD

To measure risks effectively, security professionals use structured frameworks to categorize and assess threats.

🔹 STRIDE – Identifying Threats

STRIDE is a model that categorizes security threats into six types:

Category	Description	Example
Spoofing	Can an attacker pretend to be someone else?	weak authentication in login systems
Tampering	Can data be modified by an attacker?	changing transaction amounts in online banking
Repudiation	Can a user deny actions they performed?	lack of audit logs in a financial system
Information Disclosure	Can sensitive data be leaked?	unencrypted medical records
Denial of Service	Can the system be overwhelmed?	DDoS attack on an e-commerce website
Elevation of Privilege	Can attackers gain unauthorized access?	unpatched software vulnerabilities allowing admin access

🔹 Example:

A ride-hailing app might use STRIDE to analyze risks:

• Spoofing: Can fake drivers impersonate real ones?

• Tampering: Can ride prices be manipulated?

• Denial of Service: Can attackers flood the system with fake requests?

🔹 DREAD – Evaluating Risk Severity

Once threats are identified, DREAD helps prioritize them based on five factors:

Factor	Description
Damage Potential	How severe is the impact?
Reproducibility	How easily can it be exploited?
Exploitability	How simple is the attack?
Affected Users	How many people are impacted?
Discoverability	How easy is it to find the vulnerability?

🔹 Example:

Consider a payment gateway vulnerability:

• High damage potential – Can lead to financial loss.

• Easily reproducible – Attackers can replicate it.

• High exploitability – No special tools needed.

• Affects millions of users – All transactions are at risk.

• Highly discoverable – Security researchers or hackers may spot it.

With a high DREAD score, this vulnerability becomes a top priority for fixing.

2. Assessing the Impact of Failures and Attacks

Not all risks are equal. We must measure their impact in terms of business continuity, user safety, and legal consequences.

🔹 Example:

• Minor risk: A typo in a privacy policy (low impact, easy fix).

• Moderate risk: A temporary service outage for a small region (medium impact, affects some users).

• High risk: A data breach exposing user passwords (major impact, can lead to identity theft and lawsuits).

By ranking risks, organizations can focus on critical issues first.

3. Risk Prioritization and Mitigation Strategies

Once risks are identified and assessed, organizations need a strategic approach to address them.

🔹 Prioritization Strategies

1. Fix High-Risk Vulnerabilities First – Immediate patches for critical flaws.

2. Implement Security Layers – Use firewalls, encryption, and monitoring to reduce attack surfaces.

3. Automate Security Checks – Continuous scanning and penetration testing help detect vulnerabilities early.

🔹 Example:

A cloud storage provider discovers two security flaws:

1. Weak API authentication (High risk – could allow unauthorized access).

2. Inconsistent UI security warnings (Low risk – minor confusion for users).

The authentication issue is fixed immediately, while the UI fix is scheduled for later.

Key Takeaways

✅ Use STRIDE to classify threats and DREAD to measure their severity.

✅ Assess risks based on impact on users, business, and security.

✅ Prioritize high-impact vulnerabilities and implement layered security for better protection.

By measuring and managing security risks effectively, organizations can proactively prevent cyber threats and enhance system reliability. 🚀