Threat modeling is the practice of identifying and prioritizing potential threats to a system, typically performed during the design phase. STRIDE is the industry-standard mnemonic for categorizing these threats.
The STRIDE Model
Each letter in STRIDE corresponds to a specific type of threat and violates a specific property of information security.
1. Spoofing Identity
Violates: Authentication
Spoofing involves an entity posing as another entity. Ideally, systems should authenticate every entity on every interaction.
Mitigations:
- Strong Authentication (Multi-Factor Authentication).
- Digital Signatures (PKI).
- Secure production identity managment.
2. Tampering with Data
Violates: Integrity
Tampering defines the unauthorized modification of data, whether in transit, at rest, or in process.
Mitigations:
- Cryptographic hashing and signatures.
- Access Control Lists (ACLs).
- Immutable audit logs.
3. Repudiation
Violates: Non-repudiation
Repudiation refers to the ability of a user to deny having performed an action. Without non-repudiation, it is impossible to prove who is responsible for an event.
Mitigations:
- Comprehensive, tamper-proof logging.
- Digital signatures on transactions.
4. Information Disclosure
Violates: Confidentiality
Information disclosure is the exposure of information to individuals who are not supposed to have access to it.
Mitigations:
- Encryption (at rest and in transit).
- Data Minimization.
- Strict Access Controls.
5. Denial of Service (DoS)
Violates: Availability
DoS attacks deny service to valid users, typically by exhausting resources (network, CPU, or memory).
Mitigations:
- Rate limiting and throttling.
- Content Delivery Networks (CDNs).
- Elastic scaling architectures.
6. Elevation of Privilege
Violates: Authorization
Elevation of privilege occurs when a user gains capabilities they were not authorized to use (e.g., a standard user becoming an admin).
Mitigations:
- Principle of Least Privilege.
- Role-Based Access Control (RBAC).
- Input validation and parameterized queries.
Implementing STRIDE in Development
Threat modeling should be an iterative process integrated into the SDLC.
- Diagram: Create Data Flow Diagrams (DFDs) of the system.
- Identify: For each element in the DFD (External Entity, Process, Data Store, Data Flow), apply the relevant STRIDE categories.
- Mitigate: Determine if the threat is already mitigated or if new controls are required.
- Validate: Verify that mitigations are implemented and effective.
Strategic Value: Identifying a flaw during the design phase using STRIDE is significantly cheaper than fixing a vulnerability found in production.