<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: performing-pasta-methodology
description: >-
  Execute the 7-stage Process for Attack Simulation and Threat Analysis (PASTA) methodology for risk-centric threat modeling that aligns technical threats with business objectives and impact analysis.
domain: cybersecurity
subdomain: threat-modeling
tags:
  - pasta
  - risk-centric
  - business-impact
  - attack-simulation
  - threat-analysis
  - 7-stage
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1190", "T1078", "T1059", "T1053"]
---

# Performing PASTA Methodology

## Overview

PASTA (Process for Attack Simulation and Threat Analysis) is a 7-stage risk-centric threat
modeling methodology that bridges business objectives with technical security analysis. This
technique covers all seven stages from objective definition through countermeasure analysis.

Mode: `[MODE: ARCHITECT]` — Risk-centric threat analysis aligned with business objectives.

## Prerequisites

- Business objectives and risk appetite documentation
- Application architecture diagrams and data flow documentation
- Vulnerability scan results and penetration test reports
- Threat intelligence feeds for relevant attack patterns
- Python 3.10+

## Key Concepts

### PASTA 7 Stages

| Stage | Name | Deliverable |
|-------|------|-------------|
| 1 | Define Objectives | Business impact analysis, compliance requirements |
| 2 | Define Technical Scope | Architecture diagrams, technology inventory |
| 3 | Application Decomposition | DFDs, trust boundaries, entry points |
| 4 | Threat Analysis | Threat intelligence, attack patterns, TTPs |
| 5 | Vulnerability Analysis | Vulnerability correlation, weakness mapping |
| 6 | Attack Modeling | Attack trees, simulation scenarios |
| 7 | Risk & Impact Analysis | Residual risk, countermeasure priorities |

### Business-Technical Alignment

PASTA uniquely bridges:
- **Business context**: revenue impact, regulatory exposure, reputational damage
- **Technical reality**: actual vulnerabilities, exploitable paths, control gaps
- **Risk quantification**: probability × impact with monetary estimates

## Workflow

### Step 1: Define Business Objectives (Stage 1)

```bash
node scripts/agent.js --action stage1 --objectives "Protect customer PII,Maintain 99.9% uptime"
```

### Step 2: Define Technical Scope (Stage 2)

```bash
node scripts/agent.js --action stage2 --components components.json
```

### Step 3: Decompose Application (Stage 3)

```bash
node scripts/agent.js --action stage3 --dfd dfd.json --output decomposition.json
```

### Step 4–6: Threat, Vulnerability & Attack Analysis

```bash
node scripts/agent.js --action analyze --input decomposition.json --output analysis.json
```

### Step 7: Risk and Countermeasure Report

```bash
node scripts/agent.js --action report --input analysis.json --output pasta-report.json
```

## Verification

- [ ] Business objectives documented with measurable impact criteria
- [ ] Technical scope includes all components, dependencies, and data flows
- [ ] DFD decomposition covers all trust boundaries and entry points
- [ ] Threat analysis references current threat intelligence
- [ ] Vulnerabilities correlated with identified threats
- [ ] Attack models validate exploitability of threat-vulnerability pairs
- [ ] Risk scores align with business impact and are prioritized

## References

- [PASTA Threat Modeling](https://versprite.com/tag/pasta-threat-modeling/)
- [OWASP Threat Modeling](https://owasp.org/www-community/Threat_Modeling)
- [Risk Centric Threat Modeling — Tony UcedaVélez](https://www.wiley.com/en-us/Risk+Centric+Threat+Modeling-p-9780470500965)
