Threat Modeling with STRIDE

Introduction to Threat Modeling with STRIDE

Threat modeling is a systematic approach to identifying, quantifying, and addressing security risks in an application or system. The STRIDE methodology is one of the most widely recognized frameworks for conducting threat modeling, particularly in the context of CompTIA Security+ certification. Understanding STRIDE is essential for security professionals who need to design secure systems and protect against sophisticated attacks.

Why Threat Modeling with STRIDE is Important

Proactive Security Design: STRIDE helps organizations identify threats before systems are deployed, allowing for cost-effective security implementations at the design phase rather than expensive fixes after deployment.

Comprehensive Coverage: The STRIDE methodology ensures that all major categories of threats are considered systematically, preventing security blind spots.

Risk Prioritization: By categorizing threats, STRIDE enables security teams to prioritize mitigation efforts based on impact and likelihood.

Compliance and Standards: STRIDE aligns with security frameworks and compliance requirements, making it valuable for regulatory adherence.

Communication Tool: STRIDE provides a common language for security teams, developers, and stakeholders to discuss threats consistently.

What is STRIDE?

STRIDE is an acronym developed by Microsoft that represents six categories of security threats:

1. Spoofing (Identity)
Spoofing involves an attacker pretending to be someone or something they are not. This threat targets authentication mechanisms and identity verification. Examples include:

• An attacker claiming to be an authorized user
• IP address spoofing
• DNS spoofing or cache poisoning
• Forged credentials or certificates

2. Tampering (Integrity)
Tampering refers to unauthorized modification of data or systems. This threat targets data integrity. Examples include:

• Modifying files, databases, or network traffic
• Altering configuration settings
• Changing application code or binaries
• Man-in-the-middle attacks that modify data in transit

3. Repudiation
Repudiation occurs when a user denies performing an action that they actually did, with no way to prove otherwise. This threat targets accountability and non-repudiation. Examples include:

• A user claiming they didn't send an email
• Denying access to a system without audit logs
• Lack of digital signatures on transactions
• Insufficient logging of user actions

4. Information Disclosure
Information disclosure is the unauthorized access to sensitive data. This threat targets confidentiality. Examples include:

• Reading unencrypted data in transit or at rest
• Accessing files without proper access controls
• Side-channel attacks that leak information
• Inadvertent exposure of sensitive information in error messages

5. Denial of Service (DoS)
Denial of Service attacks prevent legitimate users from accessing services. This threat targets availability. Examples include:

• Distributed Denial of Service (DDoS) attacks
• Resource exhaustion attacks
• Flooding attacks (SYN floods, UDP floods)
• Application-level DoS attacks

6. Elevation of Privilege
Elevation of privilege occurs when an unprivileged user gains higher-level permissions. This threat targets authorization. Examples include:

• Exploiting software vulnerabilities to gain admin access
• Privilege escalation attacks
• Bypassing authorization controls
• Accessing resources above one's clearance level

How STRIDE Works: The Threat Modeling Process

Step 1: Define the System Scope
Begin by clearly defining what system or application you are analyzing. Create a data flow diagram (DFD) that shows:

• System components and services
• Data flows between components
• Trust boundaries
• External entities and systems

Step 2: Identify Assets and Trust Boundaries
Determine what you're protecting (data, systems, users) and identify where trust boundaries exist. Trust boundaries indicate where data transitions from one protection domain to another.

Step 3: Apply STRIDE to Each Element
For each system component, data flow, and interaction point, apply the STRIDE categories:

• Ask: Can this component be spoofed?
• Ask: Can this data be tampered with?
• Ask: Can someone deny performing this action?
• Ask: Can sensitive information be disclosed?
• Ask: Can this service be denied to legitimate users?
• Ask: Can privileges be elevated?

Step 4: Document Identified Threats
For each threat identified, document:

• The threat category (which STRIDE element)
• Affected asset or component
• Attack scenario and methodology
• Potential impact
• Current mitigations (if any)

Step 5: Develop Mitigation Strategies
For each identified threat, develop countermeasures:

• Spoofing threats: Implement strong authentication, digital signatures, certificates
• Tampering threats: Use encryption, integrity checks, code signing
• Repudiation threats: Implement comprehensive logging and auditing
• Information Disclosure threats: Apply encryption, access controls, data classification
• Denial of Service threats: Implement rate limiting, redundancy, load balancing
• Elevation of Privilege threats: Apply principle of least privilege, secure coding, access controls

Step 6: Review and Validate
Review identified threats and mitigations with stakeholders, developers, and security experts to ensure completeness and effectiveness.

Practical Example: Web Application Threat Modeling

Consider a simple web application with a login function:

Spoofing: An attacker could create a fake login page to capture credentials. Mitigation: Implement HTTPS, use secure authentication tokens, educate users about phishing.

Tampering: An attacker could intercept and modify login requests. Mitigation: Use TLS/SSL encryption, implement message authentication codes, use secure cookies with HTTPOnly flag.

Repudiation: A user could deny logging in and accessing sensitive data. Mitigation: Implement comprehensive audit logging of all authentication attempts and data access.

Information Disclosure: Credentials or session tokens could be exposed in transit. Mitigation: Use HTTPS, never log credentials, implement secure session management.

Denial of Service: An attacker could flood the login endpoint with requests. Mitigation: Implement rate limiting, account lockout policies, use CAPTCHA, employ load balancing.

Elevation of Privilege: An attacker could exploit a vulnerability to access admin functions. Mitigation: Apply principle of least privilege, use secure coding practices, implement authorization checks, keep software patched.

How to Answer Questions on Threat Modeling with STRIDE in Exams

Question Type 1: Identifying Which STRIDE Category a Threat Belongs To
Example: "An attacker modifies user data in a database without authorization. Which STRIDE category does this represent?"
Answer Strategy: Focus on the action being performed. Modification/unauthorized change = Tampering. Look for keywords like "modify," "alter," "change," "corrupt."

Question Type 2: Matching Threats to Mitigations
Example: "To prevent Information Disclosure threats in a web application, which of the following is most effective?"
Answer Strategy: Remember the core defense for each STRIDE element:

• Spoofing → Authentication mechanisms
• Tampering → Integrity protection (encryption, hashing)
• Repudiation → Logging and auditing
• Information Disclosure → Encryption and access controls
• Denial of Service → Availability measures (rate limiting, redundancy)
• Elevation of Privilege → Authorization and access control

Question Type 3: Scenario-Based Threat Modeling
Example: "In a system architecture diagram, identify all STRIDE threats at the data flow between the client and server."
Answer Strategy: Systematically go through each STRIDE element for the identified component or data flow. Consider what security properties could be violated at that point.

Question Type 4: Selecting Appropriate Threat Modeling Approach
Example: "Which approach is best for identifying security threats in a distributed microservices architecture?"
Answer Strategy: STRIDE is particularly effective for component-based and distributed architectures. Consider other elements like data classification and trust boundaries.

Exam Tips: Answering Questions on Threat Modeling with STRIDE

Tip 1: Remember the STRIDE Acronym
Create a mental association for each letter to quickly recall all six categories. Practice saying "Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege" until it becomes automatic.

Tip 2: Associate STRIDE with Security Properties
Link each STRIDE element to a foundational security property:

• Spoofing → Authentication
• Tampering → Integrity
• Repudiation → Accountability (Non-repudiation)
• Information Disclosure → Confidentiality
• Denial of Service → Availability
• Elevation of Privilege → Authorization

Tip 3: Understand the Difference Between Related Categories
Spoofing vs. Elevation of Privilege: Spoofing is pretending to be someone you're not (identity deception), while elevation of privilege is gaining higher permissions than you should have. An attacker might spoof an admin account (spoofing) or gain admin access by exploiting a vulnerability (elevation).

Tampering vs. Information Disclosure: Tampering involves unauthorized modification of data, while information disclosure involves unauthorized access/reading of data.

Tip 4: Look for Keywords in Questions
Develop keyword recognition skills:

• Spoofing keywords: "Impersonate," "pretend," "forge," "fake," "clone"
• Tampering keywords: "Modify," "alter," "corrupt," "change," "unauthorized modification"
• Repudiation keywords: "Deny," "no proof," "claim they didn't," "accountability"
• Information Disclosure keywords: "Access," "read," "expose," "leak," "confidential data"
• Denial of Service keywords: "Unavailable," "crash," "overwhelm," "flood," "resource exhaustion"
• Elevation of Privilege keywords: "Gain access," "higher permissions," "admin," "escalate"

Tip 5: Understand Data Flow Diagrams (DFDs)
Exam questions often present DFDs showing system architecture. Be prepared to:

• Identify trust boundaries (marked by dotted lines)
• Recognize data flows between components
• Identify where each STRIDE threat could occur
• Suggest appropriate mitigations

Tip 6: Focus on Practical Mitigations
When asked about mitigations, think practically:

• For Spoofing: Multi-factor authentication, digital certificates, strong password policies
• For Tampering: Encryption (TLS/SSL), digital signatures, hash verification
• For Repudiation: Audit logging, transaction logs, digital signatures
• For Information Disclosure: Encryption at rest and in transit, access controls, data classification
• For DoS: Rate limiting, load balancing, failover mechanisms, DDoS mitigation services
• For Elevation of Privilege: Principle of least privilege, code reviews, security testing, patch management

Tip 7: Combine STRIDE with Other Security Frameworks
Be aware that STRIDE may be used alongside:

• OWASP Top 10: For web application-specific threats
• Attack Trees: For hierarchical threat analysis
• Risk Assessment: For quantifying threat severity
• Defense in Depth: For layered mitigation strategies

Tip 8: Practice Distinguishing Between Similar Scenarios
Create flashcards with scenarios and practice identifying the correct STRIDE category. Common confusion points:

• Spoofing (pretending to be someone) vs. Elevation of Privilege (gaining higher access)
• Tampering (modifying) vs. Information Disclosure (reading)
• Denial of Service vs. Information Disclosure (both negatively impact users but differently)
• Repudiation vs. Information Disclosure (both may lack auditing but serve different purposes)

Tip 9: Consider the Attacker's Perspective
When analyzing threats, think like an attacker. Ask:

• Can I impersonate a legitimate user or component? (Spoofing)
• Can I modify data without detection? (Tampering)
• Can I perform an action and deny it later? (Repudiation)
• Can I access data I shouldn't see? (Information Disclosure)
• Can I prevent others from accessing services? (DoS)
• Can I gain higher access than I should have? (Elevation of Privilege)

Tip 10: Know the Difference Between STRIDE and Other Threat Models
Be clear on STRIDE's focus and limitations:

• STRIDE: Component/data flow-based threat categorization
• PASTA (Process for Attack Simulation and Threat Analysis): Seven-stage methodology
• Attack Trees: Hierarchical representation of attack paths
• Asset-driven: Focuses on protecting specific assets

For CompTIA Security+ exams, STRIDE is typically the primary threat modeling framework tested, so understanding it deeply is essential.

Tip 11: Time Management Strategy
When you encounter a STRIDE-based question:

1. Read the question carefully and identify what's being asked (the threat, component, or mitigation)
2. If a scenario is presented, quickly identify the STRIDE category by looking for action keywords
3. Eliminate obviously wrong answers (those that address unrelated security properties)
4. Select the answer that most directly addresses the identified threat

Tip 12: Study Real-World Examples
Strengthen your understanding by analyzing real security breaches and categorizing them:

• Target data breach: Information Disclosure (unauthorized access to customer payment data)
• WannaCry ransomware: Tampering/Denial of Service (modifying files, making them inaccessible)
• SQL injection attacks: Tampering and Information Disclosure (modifying database commands, accessing unauthorized data)
• DDoS attacks: Denial of Service (overwhelming servers with traffic)

Key Takeaways

STRIDE Methodology Importance: Systematic threat identification prevents costly security failures and ensures comprehensive coverage of potential attacks.

Six Categories: Each STRIDE element targets a different security property—remember to link them to Authentication, Integrity, Accountability, Confidentiality, Availability, and Authorization.

Practical Application: STRIDE works by examining each system component and data flow, asking whether each type of threat could occur, and documenting appropriate mitigations.

Exam Success: Master keyword recognition, understand practical mitigations, and practice scenario analysis to excel at STRIDE-based exam questions.

Continuous Learning: Threat modeling is an evolving field. Stay updated on emerging threats and how STRIDE can be adapted to address them.

By thoroughly understanding STRIDE and practicing with diverse scenarios, you'll be well-prepared to answer threat modeling questions on the CompTIA Security+ exam and apply this knowledge in real-world security contexts.