Threat Modelling with STRIDE
What Is Threat Modelling?
Threat modelling is the systematic process of identifying, categorising, and prioritising potential threats to a system — before an attacker exploits them. It is a proactive engineering activity, not a reactive incident-response activity.
The output of threat modelling is not “everything is secure.” It is a structured understanding of the system’s attack surface, allowing the engineering team to allocate defensive resources to the highest-impact threats.
STRIDE
STRIDE is a mnemonic checklist developed at Microsoft that categorises threats into six types. For each component and each data flow in a system design, you ask: could this be susceptible to…?
| Category | Definition | Concrete example |
|---|---|---|
| Spoofing | Pretending to be someone or something else | An attacker logs in with a stolen password or forges a source IP address. A malicious server in a federated network claims a post was authored by a user on a different server. |
| Tampering | Unauthorised modification of data or code — in transit (man-in-the-middle) or at rest (modifying database rows directly) | An attacker intercepts an HTTP request and changes the transfer amount from £100 to £10,000. A malicious administrator directly edits database records. |
| Repudiation | Denying having performed an action, in the absence of an audit trail | A user claims “I never made that trade,” but the system has no cryptographic proof (e.g. a digital signature) that they did. |
| Information Disclosure | Exposing data to unauthorised parties — in transit (unencrypted Wi-Fi) or at rest (unencrypted database backups) | A server accidentally logs a user’s password in plaintext; the log file is later compromised. A misconfigured S3 bucket makes customer data publicly readable. |
| Denial of Service | Degrading or blocking legitimate access to a service | An attacker floods the login endpoint with requests, preventing genuine users from authenticating. A malformed federated message causes the receiving server to crash. |
| Elevation of Privilege | Gaining capabilities beyond what was granted — e.g. a normal user becoming root, or reading files outside their permission set | A buffer overflow in a privileged daemon lets an attacker execute arbitrary code as root. A user exploits a missing authorisation check to access another user’s private data. |
Using STRIDE in Practice
STRIDE is not a formal verification tool — it is a structured brainstorming framework. The process:
- Decompose the system into components and data flows.
- For each component and each flow, walk through the six STRIDE categories.
- For each credible threat, assess: likelihood × impact → priority.
- Design mitigations for high-priority threats.
The output is a threat model document — a living artefact updated as the system evolves — not a one-off exercise performed during initial design and then forgotten.
STRIDE in Exam Answers
When asked to analyse the security of a described system, walk each STRIDE category against the specific components and flows in the scenario, not just recite the mnemonic generically.
For example, for the 2025 Tripos decentralised social network scenario:
- Spoofing: a malicious server operator could forge posts claiming to be from a user on another server, since cross-server trust is currently based on the sending server’s word alone.
- Tampering: a post’s content could be modified in transit between servers if the transport is unencrypted or lacks integrity-checking.
- Repudiation: without cryptographic signatures on posts, a user could plausibly deny having authored a controversial post.
- Information Disclosure: a server could leak private messages or user metadata to unauthorised third parties.
- Denial of Service: a hostile server could flood another server with malformed federation messages, exhausting resources or crashing the parser.
- Elevation of Privilege: a bug in a privileged server component (e.g. the admin API) could let a normal user perform administrator actions.
Concrete, scenario-specific application of STRIDE is rewarded. Generic recitation is not.
Expected Learning
- Define threat modelling and explain its role in the software lifecycle.
- Recite the six STRIDE categories and give a concrete technical example of each.
- Apply STRIDE to a described system’s data flows, producing specific, scenario-relevant threats rather than generic ones.
Past Paper Questions
The 2025 Tripos Paper 2 Q5(b) implicitly tests STRIDE: the question asks about introducing public-key authentication, which directly mitigates Spoofing and Repudiation in the federated setting. Expect to apply STRIDE in any question asking you to “analyse the security” or “identify vulnerabilities” of a described distributed system.