While the STRIDE methodology can be used to identify threats, the DREAD methodology can be effective in rating the threats. DREAD is an abbreviation for the following terms:
- D—damage potential: The damage potential factor defines the potential damage that might be caused if an exploit is successful.
- R—reproducibility: The reproducibility factor defines how easy or difficult it is to reproduce the exploit. A certain exploit may be very easy to reproduce while another might be difficult due to multiple dependencies.
- E—exploitability: The exploitability factor defines what exactly is required in order to make the exploit successful. This may include knowledge about a specific area, or skills with a certain tool, and so on.
- A—affected ...