juhan6910-pfrsa

Blog By: Kenneth Juhan

Date: August 12, 2026

Kenny Juhan will explain Attack patterns and Frameworks in the following blog.

Threat Modeling Frameworks Every SecurityX Candidate Should Recognize

Security professionals need structured ways to understand how attackers operate, how systems can be targeted, and where defensive controls should be placed. Without a structured model, security analysis becomes inconsistent and reactive rather than proactive.

SecurityX includes several frameworks and models that approach this problem from different angles: MITRE ATT&CK, CAPEC, the Cyber Kill Chain, the Diamond Model, STRIDE, and OWASP.

The goal is not to memorize every detail of each framework, but to understand what each one is designed to help you see.

MITRE ATT&CK

MITRE ATT&CK documents adversary tactics, techniques, and sub-techniques (TTPs) based on real-world observed attacker behavior. It is continuously updated as new attack methods are discovered in the wild.

Think:

ATT&CK = What attackers do

Security teams use ATT&CK to map detections, identify coverage gaps, perform threat hunting, and simulate adversary behavior during red team exercises. It is especially useful for understanding how attackers move through environments after initial access.

For example, ATT&CK can help answer questions like:

• How does an attacker escalate privileges in a Windows environment?
• What tools are commonly used for lateral movement?
• What persistence techniques are most frequently observed?

Because of its depth, ATT&CK is often used as a “common language” between blue teams, red teams, and threat intelligence analysts.

CAPEC

Common Attack Pattern Enumeration and Classification (CAPEC) is a structured catalog of known attack patterns. It focuses on describing how attacks are generally performed in a repeatable and categorized way.

Think:

CAPEC = Catalog of attack patterns

While ATT&CK focuses strongly on real adversary behavior and TTPs, CAPEC is more abstract and educational. It helps security professionals understand common methods such as buffer overflows, injection attacks, or social engineering patterns.

CAPEC is especially useful in:

• Secure design reviews
• Threat identification during early development
• Training and awareness programs

It provides a bridge between theoretical attack concepts and real-world exploitation techniques.

Cyber Kill Chain

The Cyber Kill Chain, developed by Lockheed Martin, models an attack as a sequence of stages that an adversary typically follows from reconnaissance to objective completion.

The major value of this model is understanding that defenders may have multiple opportunities to interrupt an attack before it reaches its final goal.

Think:

Kill Chain = Attack progression

Typical stages include reconnaissance, weaponization, delivery, exploitation, installation, command and control, and actions on objectives.

Security teams use this model to:

• Identify where controls can break the attack chain
• Improve detection at earlier stages
• Understand how attacks evolve over time

The earlier an attack is stopped in the chain, the lower the impact and cost to the organization.

Diamond Model

The Diamond Model of Intrusion Analysis focuses on relationships between four key elements:

Adversary → Capability → Infrastructure → Victim

Instead of viewing attacks as linear steps, the Diamond Model emphasizes connections and context.

Think:

Diamond = Connect the attacker, tools, infrastructure, and victim

This model is especially useful in threat intelligence analysis because it helps analysts:

• Attribute activity to specific threat actors
• Understand infrastructure reuse across campaigns
• Correlate multiple incidents into a single campaign

It is more analytical than procedural, making it valuable for advanced investigations and intelligence-driven security operations.

STRIDE

STRIDE is a threat modeling framework used primarily during system design and architecture review. It helps identify potential security issues before systems are built or deployed.

It represents:

• Spoofing
• Tampering
• Repudiation
• Information Disclosure
• Denial of Service
• Elevation of Privilege

Think:

STRIDE = Threat categories

STRIDE is especially useful when reviewing:

• Data-flow diagrams
• Application architecture diagrams
• API designs
• Cloud system designs

By categorizing threats early, developers and security architects can design controls that prevent vulnerabilities rather than reacting after deployment.

---

OWASP

The Open Worldwide Application Security Project (OWASP) provides widely used application security resources, tools, and best practices. It is one of the most recognized organizations in web application security.

Think:

OWASP = Application and web security

OWASP is best known for the OWASP Top 10, which highlights the most critical web application security risks such as injection flaws, broken authentication, and security misconfigurations.

OWASP is widely used in:

• Secure coding practices
• Application security testing
• Developer training programs
• Security requirements definition

It is especially important in modern cloud-native and API-driven environments.

Why This Matters for SecurityX

The biggest mistake candidates make is treating these frameworks as interchangeable. In reality, each one answers a different type of security question.

The key is to match the scenario to the correct model.

If the organization wants to understand adversary tactics and techniques:

MITRE ATT&CK

If it wants a catalog of attack patterns:

CAPEC

If it wants to understand attack stages and progression:

Cyber Kill Chain

If analysts are connecting adversaries, capabilities, infrastructure, and victims:

Diamond Model

If developers are categorizing potential design-level threats:

STRIDE

If the focus is web or application security risks:

OWASP

SecurityX questions often reward recognition and contextual understanding rather than memorization of every technical detail. You are expected to identify the best-fit framework based on the situation described.

A useful memory chain is:

ATT&CK = TTPs
CAPEC = Patterns
Kill Chain = Stages
Diamond = Relationships
STRIDE = Threat categories
OWASP = Application security

Once these associations become automatic, it becomes much easier to quickly eliminate incorrect answers and select the most appropriate framework in exam scenarios.

In real-world security work, this same skill helps professionals choose the right analytical lens for investigations, architecture reviews, and threat intelligence reporting.