PASTA Threat Modeling & Leveraging IR, Threat Intelligence as Means for Tactical Pen Test

The talk focuses on stage four of PASTA, the risk-centric threat modeling method, and on how a threat library can be backed by evidence rather than kept as a compliance checkbox. The speaker argues that alerts from firewalls, web application firewalls and endpoint tools, along with industry advisories and incident postmortems, are usually triaged and then forgotten. Feeding them back into the model gives adversarial testers a reason to target particular components.

Two case studies anchor the argument. The first covers a connected children's toy whose companion app, cloud APIs and backend database were linked to a breach after a staging environment held real user records. The second covers an energy-sector SaaS used to monitor oil well production, where a misconfigured tenant management page gave access to a client's well sites and production data. For each, the speaker walks through how a threat such as data theft, sabotage or tampering maps to assets, vulnerabilities, attacks and countermeasures in an attack tree.

The closing takeaway is that threat intelligence should be operationalized into the model rather than merely subscribed to, and that a threat-to-attack blueprint lets a pentester test for abuse cases the business actually cares about. The speaker recommends building the model collaboratively with developers and product owners, using frameworks such as ATT&CK and OWASP ASVS for mapping, and applying the approach to both legacy and new products.