What is the relationship between STRIDE, DREAD, and Attack Trees?

Question

Accepted Answer

They're complementary, not competing: STRIDE finds threats, DREAD ranks them, Attack Trees deep-dive the worst — identify, prioritise, analyse.
STRIDE, DREAD, and Attack Trees are complementary threat modeling techniques:

Tool
Purpose
When to Use

STRIDE
Classify threats by type
During threat identification

DREAD
Rate risk of each threat
After identifying threats, to prioritize

Attack Trees
Visualize attack paths
For complex scenarios, to understand attacker options

Workflow:

Use STRIDE per DFD element to identify threats
Use DREAD (or CVSS/OWASP) to rate and prioritize threats
Use Attack Trees to deep-dive into high-priority threats and identify countermeasures

Remember: The goal isn't to use all tools on every project - pick what fits your needs.

Tool	Purpose	When to Use
STRIDE	Classify threats by type	During threat identification
DREAD	Rate risk of each threat	After identifying threats, to prioritize
Attack Trees	Visualize attack paths	For complex scenarios, to understand attacker options