Skip to main content

Frameworks Quick Guide (SALT, STRIDE, DREAD)

Premium

Frameworks help you think and communicate clearly under pressure. Security engineer interviews reward candidates who can organize complex ideas into logical, structured answers.

Which frameworks to use:

  • SALT helps you structure the solution.
  • STRIDE helps you explore what can go wrong.
  • DREAD helps you articulate which risks are most important.

You don’t need to name the frameworks out loud; just apply their structure naturally.

SALT: Structuring security system design

Use SALT (Scope, Assets, Layers, Tradeoffs) to reason through architecture and design interviews. It helps you stay organized from beginning to end.

StepWhat to askExample
ScopeWhat is being designed?“A secure login system for a web app.”
AssetsWhat needs protection?“User credentials, sessions, and PII.”
LayersWhat defenses apply at each layer?“TLS, authentication tokens, WAF, encryption, monitoring.”
TradeoffsWhat are the performance or usability costs?“Extra latency from encryption is acceptable for privacy compliance.”

When to use it:

  • System design or “How would you secure X?” questions.
  • Any open-ended architecture discussion.
  • Cases where tradeoffs or scaling are involved.

Learn more about this framework in our Security System Design course.

STRIDE: Threat modeling framework

Use STRIDE to identify and discuss potential threats in a system. It shows you can reason systematically about risk.

CategoryThreat typeExample
SSpoofing identityForged JWT tokens or fake API clients.
TTampering with dataModified logs or payloads.
RRepudiationMissing audit trails or accountability gaps.
IInformation disclosureExposed user data through misconfigured storage.
DDenial of serviceOverwhelming API with requests.
EElevation of privilegeMisconfigured IAM roles granting admin access.

When to use it:

  • Threat modeling or risk analysis questions.
  • Explaining how you anticipate and mitigate attacks.
  • Walking through potential attacker paths in system design interviews

For more details on threat modeling, visit our lesson on threat modeling.

DREAD: Prioritizing & scoring risk

Use DREAD to show how you would prioritize mitigations logically. It helps you reason about which risks matter most.

FactorQuestionExample
DamageHow bad is the impact?“Full data breach of customer information.”
ReproducibilityHow easy is it to repeat?“Single click on a public endpoint.”
ExploitabilityHow easy is it to perform?“Requires valid credentials.”
Affected UsersHow many are impacted?“All production accounts.”
DiscoverabilityHow easy is it to find?“Publicly exposed through standard scanning.”

When to use it:

  • Prioritizing which risks or vulnerabilities matter most
  • Demonstrating structured thinking in incident response scenarios
  • Explaining why you would remediate one issue before another
Next Lesson