In this lesson, we will discuss DREAD.
DREAD is a risk assessment model
used to quantify, prioritize,
and compare the level of risk from various security threats.
Originally part of Microsoft's threat modeling framework,
DREAD is an acronym for Damage potential, Reproducibility,
Exploitability, Affected users, and Discoverability.
Each of these components
assesses a different aspect of the threat,
allowing security professionals
to gauge the severity and potential impact
of security vulnerabilities within their systems.
The DREAD model allows analysts to rate,
compare, and prioritize the severity of threats
by assigning a score between 0 and 10
to each of five key categories,
with the overall threat rating determined
by adding all these scores together.
The final rating classifies the risk
into four severity categories:
Critical being (40-50),
where the vulnerability must be addressed immediately.
High is anywhere (25-39),
which indicates a severe vulnerability
that should be considered for review
and resolution pretty soon.
Medium is between (11-24),
representing a moderate risk
that should be reviewed after more severe risks.
And then low is (1-10),
posing a minimal risk to infrastructure and data.
We will walk through each component
and give an example of how to score different scenarios.
First, let's discuss Damage Potential.
Now, this component evaluates the extent of damage
that a successful exploitation
of the vulnerability could cause.
Damage can range from minor inconveniences
to significant operational disruptions
or serious breaches involving sensitive data.
For instance, a vulnerability that allows an attacker
to delete financial records
would score high in terms of damage potential.
Here's an example of scoring for a damage potential:
0: No damage.
5: Information disclosure.
8: Non-sensitive user data related to individuals
or employer compromised.
9: Non-sensitive administrative data compromised
10: Destruction of an information system;
data or application unavailability.
Next, we'll consider Reproducibility.
Now, this measures how easily a threat
can be replicated by an attacker.
A high reproducibility score is given to vulnerabilities
that can be exploited reliably
under a variety of conditions,
without the need for advanced skills
or specific circumstances.
For example, if exploiting a vulnerability
simply requires navigating to a URL,
its reproducibility is very high.
Here's an example of scoring for Reproducibility:
0: Difficult or impossible.
5: Complex
7.5: Easy
10: Very easy
Moving on to Exploitability,
this assesses the level of effort
and resources required to exploit the vulnerability.
Factors that influence this
includes the complexity of the attack
and the level of access needed.
A vulnerability that can be exploited remotely
and without authentication
would have a high exploitability score.
So, Here's an example of scoring for Exploitability:
2.5: Advanced programming and networking skills.
5: Available attack tools.
9: Web application proxies.
10: Web browser.
Then, we have Affected Users,
which quantifies the segment of the user base
that would be impacted
if the vulnerability was to be exploited.
That this could range from a single user
to the entire customer base.
The greater the number of users affected,
the higher the score.
For example, a vulnerability in a common feature
used by all users would affect a wide audience.
An example of scoring for Affected Users
will be: 0: No users.
2.5: an Individual user.
6: Few users.
8: Administrative users.
10: All users.
Lastly, Discoverabilityy refers to how easy is it
for a potential attacker to discover the vulnerability.
A high score and discoverability
is typically assigned to vulnerabilities
that are obvious or well documented
and require minimal skills to identify,
such as exposed sensitive data on a public website.
Here's our last example of scoring for Discoverability:
0: Hard to discover the vulnerability.
5: HTTP requests can uncover the vulnerability.
8: Vulnerability found in the public domain.
10: Vulnerability found in web address bar or form.
Now, while DREAD offers valuable insights
into potential risk and impacts of security vulnerabilities,
it's best to add it as part of an already existing
security assessment strategy.
DREAD should be complemented with other models and insights
from updated security practices,
as it does not account for all types
of modern cybersecurity threats,
it may oversimplify complex vulnerabilities.
So, remember, DREAD is a tool for risk assessment,
helping prioritize security efforts effectively.
It aids organizations in making informed decisions
about which vulnerabilities require immediate attention
based on a quantifiable assessment
of their potential impact.
Now, understanding and applying DREAD effectively
can enhance an organization's ability to safeguard against
and mitigate the consequences of security breaches.