STRIDE Analysis Patterns

Systematic threat identification using the STRIDE methodology.

When to Use This Skill Starting new threat modeling sessions Analyzing existing system architecture Reviewing security design decisions Creating threat documentation Training teams on threat identification Compliance and audit preparation Core Concepts 1. STRIDE Categories S - Spoofing → Authentication threats T - Tampering → Integrity threats R - Repudiation → Non-repudiation threats I - Information → Confidentiality threats Disclosure D - Denial of → Availability threats Service E - Elevation of → Authorization threats Privilege

1. Threat Analysis Matrix Category Question Control Family Spoofing Can attacker pretend to be someone else? Authentication Tampering Can attacker modify data in transit/rest? Integrity Repudiation Can attacker deny actions? Logging/Audit Info Disclosure Can attacker access unauthorized data? Encryption DoS Can attacker disrupt availability? Rate limiting Elevation Can attacker gain higher privileges? Authorization Templates Template 1: STRIDE Threat Model Document

Threat Model: [System Name]

1. System Overview

1.1 Description

[Brief description of the system and its purpose]

1.2 Data Flow Diagram

[User] --> [Web App] --> [API Gateway] --> [Backend Services] | v [Database]

1.3 Trust Boundaries

• External Boundary: Internet to DMZ
• Internal Boundary: DMZ to Internal Network
• Data Boundary: Application to Database

2. Assets

3. STRIDE Analysis

3.1 Spoofing Threats

Mitigations: - [ ] Implement MFA - [ ] Use secure session management - [ ] Implement account lockout policies

3.2 Tampering Threats

Mitigations: - [ ] Input validation on all endpoints - [ ] Parameterized queries - [ ] File type validation

3.3 Repudiation Threats

Mitigations: - [ ] Comprehensive audit logging - [ ] Log integrity protection - [ ] Digital signatures for critical actions

3.4 Information Disclosure Threats

Mitigations: - [ ] Encryption at rest and in transit - [ ] Sanitize error messages - [ ] Implement TLS 1.3

3.5 Denial of Service Threats

Mitigations: - [ ] Rate limiting - [ ] Auto-scaling - [ ] DDoS protection

3.6 Elevation of Privilege Threats

Mitigations: - [ ] Proper authorization checks - [ ] Principle of least privilege - [ ] Server-side role validation

4. Risk Assessment

4.1 Risk Matrix

      IMPACT
 Low  Med  High Crit

Low 1 2 3 4

L Med 2 4 6 8 I High 3 6 9 12 K Crit 4 8 12 16

4.2 Prioritized Risks

5. Recommendations

Immediate Actions

1. Implement input validation framework
2. Add rate limiting to authentication endpoints
3. Enable comprehensive audit logging

Short-term (30 days)

1. Deploy WAF with OWASP ruleset
2. Implement MFA for sensitive operations
3. Encrypt all PII at rest

Long-term (90 days)

1. Security awareness training
2. Penetration testing
3. Bug bounty program

Template 2: STRIDE Analysis Code from dataclasses import dataclass, field from enum import Enum from typing import List, Dict, Optional import json

class StrideCategory(Enum): SPOOFING = "S" TAMPERING = "T" REPUDIATION = "R" INFORMATION_DISCLOSURE = "I" DENIAL_OF_SERVICE = "D" ELEVATION_OF_PRIVILEGE = "E"

class Impact(Enum): LOW = 1 MEDIUM = 2 HIGH = 3 CRITICAL = 4

class Likelihood(Enum): LOW = 1 MEDIUM = 2 HIGH = 3 CRITICAL = 4

@dataclass class Threat: id: str category: StrideCategory title: str description: str target: str impact: Impact likelihood: Likelihood mitigations: List[str] = field(default_factory=list) status: str = "open"

@property
def risk_score(self) -> int:
    return self.impact.value * self.likelihood.value

@property
def risk_level(self) -> str:
    score = self.risk_score
    if score >= 12:
        return "Critical"
    elif score >= 6:
        return "High"
    elif score >= 3:
        return "Medium"
    return "Low"

@dataclass class Asset: name: str sensitivity: str description: str data_classification: str

@dataclass class TrustBoundary: name: str description: str from_zone: str to_zone: str

@dataclass class ThreatModel: name: str version: str description: str assets: List[Asset] = field(default_factory=list) boundaries: List[TrustBoundary] = field(default_factory=list) threats: List[Threat] = field(default_factory=list)

def add_threat(self, threat: Threat) -> None:
    self.threats.append(threat)

def get_threats_by_category(self, category: StrideCategory) -> List[Threat]:
    return [t for t in self.threats if t.category == category]

def get_critical_threats(self) -> List[Threat]:
    return [t for t in self.threats if t.risk_level in ("Critical", "High")]

def generate_report(self) -> Dict:
    """Generate threat model report."""
    return {
        "summary": {
            "name": self.name,
            "version": self.version,
            "total_threats": len(self.threats),
            "critical_threats": len([t for t in self.threats if t.risk_level == "Critical"]),
            "high_threats": len([t for t in self.threats if t.risk_level == "High"]),
        },
        "by_category": {
            cat.name: len(self.get_threats_by_category(cat))
            for cat in StrideCategory
        },
        "top_risks": [
            {
                "id": t.id,
                "title": t.title,
                "risk_score": t.risk_score,
                "risk_level": t.risk_level
            }
            for t in sorted(self.threats, key=lambda x: x.risk_score, reverse=True)[:10]
        ]
    }

class StrideAnalyzer: """Automated STRIDE analysis helper."""

STRIDE_QUESTIONS = {
    StrideCategory.SPOOFING: [
        "Can an attacker impersonate a legitimate user?",
        "Are authentication tokens properly validated?",
        "Can session identifiers be predicted or stolen?",
        "Is multi-factor authentication available?",
    ],
    StrideCategory.TAMPERING: [
        "Can data be modified in transit?",
        "Can data be modified at rest?",
        "Are input validation controls sufficient?",
        "Can an attacker manipulate application logic?",
    ],
    StrideCategory.REPUDIATION: [
        "Are all security-relevant actions logged?",
        "Can logs be tampered with?",
        "Is there sufficient attribution for actions?",
        "Are timestamps reliable and synchronized?",
    ],
    StrideCategory.INFORMATION_DISCLOSURE: [
        "Is sensitive data encrypted at rest?",
        "Is sensitive data encrypted in transit?",
        "Can error messages reveal sensitive information?",
        "Are access controls properly enforced?",
    ],
    StrideCategory.DENIAL_OF_SERVICE: [
        "Are rate limits implemented?",
        "Can resources be exhausted by malicious input?",
        "Is there protection against amplification attacks?",
        "Are there single points of failure?",
    ],
    StrideCategory.ELEVATION_OF_PRIVILEGE: [
        "Are authorization checks performed consistently?",
        "Can users access other users' resources?",
        "Can privilege escalation occur through parameter manipulation?",
        "Is the principle of least privilege followed?",
    ],
}

def generate_questionnaire(self, component: str) -> List[Dict]:
    """Generate STRIDE questionnaire for a component."""
    questionnaire = []
    for category, questions in self.STRIDE_QUESTIONS.items():
        for q in questions:
            questionnaire.append({
                "component": component,
                "category": category.name,
                "question": q,
                "answer": None,
                "notes": ""
            })
    return questionnaire

def suggest_mitigations(self, category: StrideCategory) -> List[str]:
    """Suggest common mitigations for a STRIDE category."""
    mitigations = {
        StrideCategory.SPOOFING: [
            "Implement multi-factor authentication",
            "Use secure session management",
            "Implement account lockout policies",
            "Use cryptographically secure tokens",
            "Validate authentication at every request",
        ],
        StrideCategory.TAMPERING: [
            "Implement input validation",
            "Use parameterized queries",
            "Apply integrity checks (HMAC, signatures)",
            "Implement Content Security Policy",
            "Use immutable infrastructure",
        ],
        StrideCategory.REPUDIATION: [
            "Enable comprehensive audit logging",
            "Protect log integrity",
            "Implement digital signatures",
            "Use centralized, tamper-evident logging",
            "Maintain accurate timestamps",
        ],
        StrideCategory.INFORMATION_DISCLOSURE: [
            "Encrypt data at rest and in transit",
            "Implement proper access controls",
            "Sanitize error messages",
            "Use secure defaults",
            "Implement data classification",
        ],
        StrideCategory.DENIAL_OF_SERVICE: [
            "Implement rate limiting",
            "Use auto-scaling",
            "Deploy DDoS protection",
            "Implement circuit breakers",
            "Set resource quotas",
        ],
        StrideCategory.ELEVATION_OF_PRIVILEGE: [
            "Implement proper authorization",
            "Follow principle of least privilege",
            "Validate permissions server-side",
            "Use role-based access control",
            "Implement security boundaries",
        ],
    }
    return mitigations.get(category, [])

Template 3: Data Flow Diagram Analysis from dataclasses import dataclass from typing import List, Set, Tuple from enum import Enum

class ElementType(Enum): EXTERNAL_ENTITY = "external" PROCESS = "process" DATA_STORE = "datastore" DATA_FLOW = "dataflow"

@dataclass class DFDElement: id: str name: str type: ElementType trust_level: int # 0 = untrusted, higher = more trusted description: str = ""

@dataclass class DataFlow: id: str name: str source: str destination: str data_type: str protocol: str encrypted: bool = False

class DFDAnalyzer: """Analyze Data Flow Diagrams for STRIDE threats."""

def __init__(self):
    self.elements: Dict[str, DFDElement] = {}
    self.flows: List[DataFlow] = []

def add_element(self, element: DFDElement) -> None:
    self.elements[element.id] = element

def add_flow(self, flow: DataFlow) -> None:
    self.flows.append(flow)

def find_trust_boundary_crossings(self) -> List[Tuple[DataFlow, int]]:
    """Find data flows that cross trust boundaries."""
    crossings = []
    for flow in self.flows:
        source = self.elements.get(flow.source)
        dest = self.elements.get(flow.destination)
        if source and dest and source.trust_level != dest.trust_level:
            trust_diff = abs(source.trust_level - dest.trust_level)
            crossings.append((flow, trust_diff))
    return sorted(crossings, key=lambda x: x[1], reverse=True)

def identify_threats_per_element(self) -> Dict[str, List[StrideCategory]]:
    """Map applicable STRIDE categories to element types."""
    threat_mapping = {
        ElementType.EXTERNAL_ENTITY: [
            StrideCategory.SPOOFING,
            StrideCategory.REPUDIATION,
        ],
        ElementType.PROCESS: [
            StrideCategory.SPOOFING,
            StrideCategory.TAMPERING,
            StrideCategory.REPUDIATION,
            StrideCategory.INFORMATION_DISCLOSURE,
            StrideCategory.DENIAL_OF_SERVICE,
            StrideCategory.ELEVATION_OF_PRIVILEGE,
        ],
        ElementType.DATA_STORE: [
            StrideCategory.TAMPERING,
            StrideCategory.REPUDIATION,
            StrideCategory.INFORMATION_DISCLOSURE,
            StrideCategory.DENIAL_OF_SERVICE,
        ],
        ElementType.DATA_FLOW: [
            StrideCategory.TAMPERING,
            StrideCategory.INFORMATION_DISCLOSURE,
            StrideCategory.DENIAL_OF_SERVICE,
        ],
    }

    result = {}
    for elem_id, elem in self.elements.items():
        result[elem_id] = threat_mapping.get(elem.type, [])
    return result

def analyze_unencrypted_flows(self) -> List[DataFlow]:
    """Find unencrypted data flows crossing trust boundaries."""
    risky_flows = []
    for flow in self.flows:
        if not flow.encrypted:
            source = self.elements.get(flow.source)
            dest = self.elements.get(flow.destination)
            if source and dest and source.trust_level != dest.trust_level:
                risky_flows.append(flow)
    return risky_flows

def generate_threat_enumeration(self) -> List[Dict]:
    """Generate comprehensive threat enumeration."""
    threats = []
    element_threats = self.identify_threats_per_element()

    for elem_id, categories in element_threats.items():
        elem = self.elements[elem_id]
        for category in categories:
            threats.append({
                "element_id": elem_id,
                "element_name": elem.name,
                "element_type": elem.type.value,
                "stride_category": category.name,
                "description": f"{category.name} threat against {elem.name}",
                "trust_level": elem.trust_level
            })

    return threats

Template 4: STRIDE per Interaction from typing import List, Dict, Optional from dataclasses import dataclass

@dataclass class Interaction: """Represents an interaction between two components.""" id: str source: str target: str action: str data: str protocol: str

class StridePerInteraction: """Apply STRIDE to each interaction in the system."""

INTERACTION_THREATS = {
    # Source type -> Target type -> Applicable threats
    ("external", "process"): {
        "S": "External entity spoofing identity to process",
        "T": "Tampering with data sent to process",
        "R": "External entity denying sending data",
        "I": "Data exposure during transmission",
        "D": "Flooding process with requests",
        "E": "Exploiting process to gain privileges",
    },
    ("process", "datastore"): {
        "T": "Process tampering with stored data",
        "R": "Process denying data modifications",
        "I": "Unauthorized data access by process",
        "D": "Process exhausting storage resources",
    },
    ("process", "process"): {
        "S": "Process spoofing another process",
        "T": "Tampering with inter-process data",
        "I": "Data leakage between processes",
        "D": "One process overwhelming another",
        "E": "Process gaining elevated access",
    },
}

def analyze_interaction(
    self,
    interaction: Interaction,
    source_type: str,
    target_type: str
) -> List[Dict]:
    """Analyze a single interaction for STRIDE threats."""
    threats = []
    key = (source_type, target_type)

    applicable_threats = self.INTERACTION_THREATS.get(key, {})

    for stride_code, description in applicable_threats.items():
        threats.append({
            "interaction_id": interaction.id,
            "source": interaction.source,
            "target": interaction.target,
            "stride_category": stride_code,
            "threat_description": description,
            "context": f"{interaction.action} - {interaction.data}",
        })

    return threats

def generate_threat_matrix(
    self,
    interactions: List[Interaction],
    element_types: Dict[str, str]
) -> List[Dict]:
    """Generate complete threat matrix for all interactions."""
    all_threats = []

    for interaction in interactions:
        source_type = element_types.get(interaction.source, "unknown")
        target_type = element_types.get(interaction.target, "unknown")

        threats = self.analyze_interaction(
            interaction, source_type, target_type
        )
        all_threats.extend(threats)

    return all_threats

Best Practices Do's Involve stakeholders - Security, dev, and ops perspectives Be systematic - Cover all STRIDE categories Prioritize realistically - Focus on high-impact threats Update regularly - Threat models are living documents Use visual aids - DFDs help communication Don'ts Don't skip categories - Each reveals different threats Don't assume security - Question every component Don't work in isolation - Collaborative modeling is better Don't ignore low-probability - High-impact threats matter Don't stop at identification - Follow through with mitigations Resources Microsoft STRIDE Documentation OWASP Threat Modeling Threat Modeling: Designing for Security