Threat Modeling for Enterprise Applications: STRIDE, DREAD, and Practical Approaches for Australian Enterprises

Threat modeling systematically identifies security threats during application design — before vulnerabilities are built into code. Common approaches include STRIDE (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege) and DREAD (Damage, Reproducibility, Exploitability, Affected Users, Discoverability) for risk scoring. Practical threat modeling for enterprise applications involves: decomposing the application into components, identifying trust boundaries, enumerating potential threats at each boundary, and prioritising threats by business impact. Threat models directly inform penetration test scope — ensuring testing focuses on the highest-risk areas.