M9: Risk Scoring & Mitigation — Threat Modeling Guide

1Why Risk Scoring Matters

A typical threat model for a real system will produce 20–100+ threats. You can't fix all of them before launch. Risk scoring gives you a defensible, consistent basis for prioritization — so you fix the most important things first and document why.

⚠️

Without a scoring system…

Prioritization becomes political — whoever shouts loudest gets their threat fixed. Or gut feeling drives decisions. Neither is defensible to a CISO, auditor, or regulator. Scoring makes security decisions transparent and consistent.

🎯

DREAD

Simple threat-focused scoring. Good for quick team workshops. 5 dimensions, 1–10 scale per dimension.

📊

CVSS

Vulnerability-focused standard used by NVD and security researchers. More complex but universally understood.

🟥

Risk Matrix

Visual Likelihood × Impact grid. Fast, intuitive, great for stakeholder communication and teaching.

2DREAD Scoring Model

DREAD scores a threat across five dimensions on a 1–3 scale (or 1–10 for more precision). The total score determines priority. Microsoft originally created this alongside STRIDE.

Letter	Dimension	Question to Ask	Score 1	Score 2	Score 3
D	Damage	How bad is the impact if exploited?	Minimal (log spam)	Individual user harmed	All users, financial loss, data breach
R	Reproducibility	How easy is it to reproduce the attack?	Very hard, needs exact timing	Authenticated attacker	Any internet user, always works
E	Exploitability	How much skill/effort is needed?	Needs expert + custom tools	Some programming skill needed	No skill, public exploit exists
A	Affected Users	How many users are impacted?	One user	Some users (subset)	All users / anonymous
D	Discoverability	How easy to find the vulnerability?	Very obscure	Requires source code access	Visible in browser / public info

DREAD in Action — Scoring Three Threats

DREAD Score Visualization

T-01: SQL Injection via search field

Damage (3)

3/3 Reproducibility (3)

3/3 Exploitability (3)

3/3 Affected Users (3)

3/3 Discoverability (2)

2/3

Total: 14/15 → 🚨 CRITICAL — Fix immediately

T-02: Rate limit missing on password reset

Damage (2)

2/3 Reproducibility (3)

3/3 Exploitability (3)

3/3 Affected Users (2)

2/3 Discoverability (3)

3/3

Total: 13/15 → 🔴 HIGH — Next sprint

T-03: Verbose error messages in dev only

Damage (1)

1/3 Reproducibility (1)

1/3 Exploitability (2)

2/3 Affected Users (1)

1/3 Discoverability (1)

1/3

Total: 6/15 → ✅ LOW — Document & monitor

3CVSS Basics

The Common Vulnerability Scoring System (CVSS) is the industry standard for rating publicly-disclosed vulnerabilities. It's used by the NVD (National Vulnerability Database), CVE entries, and vendor security advisories.

CVSS Metric Group	What It Measures	Key Factors
Base Score	Intrinsic characteristics of the vulnerability	Attack Vector (Network/Local), Complexity, Privileges Required, User Interaction, CIA Impact
Temporal Score	How the risk changes over time	Exploit code maturity, Remediation level, Report confidence
Environmental Score	How the vulnerability applies to your specific environment	Your mitigations, modified CIA impact based on asset sensitivity

0.0–3.9

Low severity

4.0–6.9

Medium severity

7.0–8.9

High severity

9.0–10.0

Critical severity

💡

DREAD vs CVSS — When to Use Each

Use DREAD in team threat modeling workshops — it's fast, collaborative, and doesn't require deep security expertise.
Use CVSS when communicating with the broader security community, filing CVEs, or patching known vulnerabilities from the NVD. CVSS Base Score is standardized and tool-supported.

4Security Controls Catalogue

Security controls are organized by when they act in the attack lifecycle. A mature security posture has all four types:

🚧

Preventive

Stop the attack from succeeding

MFA, encryption, input validation, WAF rules, firewall policies, access controls (RBAC), parameterized queries, HTTPS enforcement

🔍

Detective

Identify attacks that are happening or have happened

SIEM/logging, anomaly detection, intrusion detection (IDS), GuardDuty, Canary tokens, honeypots, audit trails, alerting on threshold breaches

⚡

Responsive

Contain and limit damage when an attack succeeds

Incident response playbooks, automatic session revocation, account lockout, WAF block rules, circuit breakers, kill switches, feature flags

🔄

Restorative

Restore normal operation after an incident

Tested backups, disaster recovery runbooks, blue/green deployments, rollback capabilities, post-incident reviews, customer communication plans

💡

Defense in Depth — Layer All Four

Preventive controls fail. Detective controls miss things. Assume breach — even well-defended systems get compromised. Having all four layers means: when prevention fails, you detect it; when you detect it, you can respond; when you respond, you recover. This is why auditors and frameworks (ISO 27001, SOC 2, NIST) require all four categories.

5Mitigation Decision Framework

For each threat, you make one of four decisions. The risk score guides which decision is appropriate:

Mitigation Decision Tree

Every threat gets a documented decision: Eliminate, Transfer, Accept, or Mitigate. Undocumented acceptance is the same as negligence.

6Residual Risk & Documentation

Residual risk is the risk that remains after you've applied your mitigations. No control is perfect — mitigations reduce risk, not eliminate it. Documenting residual risk is as important as the threat table itself.

Threat ID	Original Risk	Mitigation Applied	Residual Risk	Decision	Owner	Review Date
T-01	Critical	MFA enforced, bcrypt hashing, rate limiting	Low	Accept residual	Backend Lead	Q2 2025
T-04	Critical	Ownership check added to all queries	Very Low	Accept residual	Backend Lead	Q2 2025
T-07	High	DB bound to localhost; firewall rule applied	Low	Accept residual	Infra Lead	Q2 2025
T-DDoS	High	Rate limiting + CloudFront WAF — 95% of attack traffic blocked	Medium	Transfer — DDoS insurance + CloudFront contract	CISO	Annual

📋

What Goes in the Residual Risk Register

The residual risk register is a living document that serves as your security compliance evidence. It shows: (1) you thought systematically about threats, (2) you made conscious decisions, (3) someone owns each decision, (4) it gets reviewed on a schedule. Auditors love it. Courts appreciate it. Your future self will thank you when re-evaluating assumptions.

7Threat Model Quality Checklist

Before declaring a threat model complete, run through this checklist:

✓
All trust boundaries are identified and drawn on the DFD
✓
All data flows are labeled with the type of data they carry
✓
Every element has been evaluated against all applicable STRIDE categories
✓
Every threat has a unique ID and written description
✓
Every threat has a risk score (DREAD or equivalent)
✓
Every threat has an explicit mitigation decision (Mitigate/Transfer/Eliminate/Accept)
✓
All "Accept" decisions are documented with rationale and owner
✓
Residual risk is documented for each threat
✓
Mitigations have been assigned to specific engineers with target dates
✓
A review date is set for the threat model to be revisited
✓
The threat model document is stored where the team can find it

8Knowledge Check

✏️ Exercise 9.1

When is "Accept" a valid mitigation decision?

Your team identifies a low-risk threat (DREAD score: 4/15) and decides not to implement any control for it. Which statement correctly describes this decision?

9Module Summary

✅

Key Takeaways

DREAD: score Damage, Reproducibility, Exploitability, Affected Users, Discoverability (1–3 per dimension)
CVSS: industry standard for known CVEs; Base Score 0–10 (Critical ≥ 9.0)
Controls: layer Preventive + Detective + Responsive + Restorative
Decisions: every threat gets Mitigate, Transfer, Eliminate, or Accept — never implicit
Residual risk: document what risk remains after mitigation; assign owner and review date
A threat model is only complete when it has a quality-checked, documented residual risk register

Risk Scoring & Mitigation Strategy

🎯 Learning Objectives