PASTA
PASTA stands for The Process for Attack Simulation and Threat Analysis.
- Define business objectives
- What’s important to your business?
- Define the technical scope of assets and components
- Identify the attack surface. Look at configuration, databases, middleware, third-party components, etc. Document all of it.
- Perform application decomposition
- Understand the relationship between the various components
- Understand use roles and permissions
- Data flow diagrams
- Analyze threats
- Detect vulnerabilities
- Identify issues by reviewing application architecture and by using scanning tools.
- Analyze and model attacks
- Build attack trees: a diagram which shows how an asset can be targeted
- Analyze risks or impacts and develop countermeasures