PASTA Threat Methodology

What Is PASTA?

The Process for Attack Simulation and Threat Analysis (PASTA) is a seven-step methodology for simulating attacks that combines an attacker-centric technical analysis with assessing and minimizing business risks and impacts. Developed in 2015 to address shortcomings found in other threat modeling frameworks, PASTA is designed to be scalable and adaptable to the needs of growing businesses. PASTA has become increasingly popular among organizations for its more intensive and strategic approach to threat modeling.

What Are the Elements of PASTA?

PASTA consists of seven distinct phases:

1. Define objectives: identify the business objectives of what is being modeled, including compliance, regulatory and standards requirements
2. Define technical scope: outline system components, their relationships and interdependencies with one another, and the attack surface
3. Decomposition and analysis: explore the internal system structure, including computational and data components, to understand how they interact in the context of use cases, user roles, and permissions
4. Threat analysis: uncover real-world threats and how they relate to the attack surface, based on lists of known attacks, threat intelligence, and analyst insights
5. Vulnerabilities and weaknesses analysis: detail system and data flows for weak points in implementation, including faulty code, with penetration testing and lists of known vulnerabilities
6. Modeling and simulation: create visual models (such as an attack tree) to show the required process steps for successful attacks
7. Risk impact analysis: summarize the findings from the previous six steps and contextualize business risks to mitigate security gaps and manage other issues

How Is PASTA Implemented?

PASTA is designed to be compatible with agile and DevOps workflows, which enables ongoing risk assessment throughout the software development lifecycle. Like other threat modeling frameworks, it requires a collaborative, cross-functional approach involving stakeholders from across the business. Workshops are used to define objectives and scope, with security teams taking the lead on subsequent analyses and modeling. Finally, risk impact analysis is conducted with a cross-organizational lens, resulting in asset-centric outputs.

What Are the Benefits of the PASTA Model?

PASTA is primarily noted for its comprehensive, business-centric application, which requires both broad stakeholder buy-in and deep dives into risk and impact analysis. PASTA's focus on attack vectors and emphasis on evidence-based threat modeling creates a rich, realistic assessment of potential threats. As such, its methodology elevates threat modeling from a software-only process to a strategic business exercise.

What Are the Shortcomings of the PASTA Model?

PASTA is complex to execute and resource-intensive, which can inhibit scaling and development agility. It is also data-reliant, requiring the availability of quality information about systems, their components, and threats to address relevant threats. However, PASTA's biggest shortcoming may be that it provides only limited guidance for mitigation strategies. Organizations embracing PASTA may need to enlist external help if in-house expertise is not sufficient.