STRIDE Threat Modeling: How to systematically identify and mitigate threats in software architecture.

The STRIDE Framework

Created by Microsoft, STRIDE evaluates architectures against 6 fundamental attacker goals. Every architectural element (Processes, Data Flows, Data Stores, Trust Boundaries) is audited against these 6 categories.

+--------------------------------------------------------------------------+
| Threat Category            Attacker Objective      Defensive Mitigation  |
+--------------------------------------------------------------------------+
| S - Spoofing               Pretending to be user   mTLS, OAuth2, WebAuthn|
| T - Tampering              Modifying data          HMAC, TLS, Checksums  |
| R - Repudiation            Denying an action took  Append-only Audit Logs|
| I - Information Disclosure Stealing secret data    KMS Encryption, Masking|
| D - Denial of Service      Exhausting resources    Rate Limiting, WAF    |
| E - Elevation of Privilege Bypassing permissions   Strict RBAC / ABAC    |
+--------------------------------------------------------------------------+

Real-World Threat Modeling Scenario: Payment Checkout API

[ User Browser ] ======( Public Internet )======> [ Ingress API Gateway ]
                                                           |
                                                ( Trust Boundary Crossed )
                                                           v
                                                  [ Payment Microservice ]
                                                           |
                                                           v
                                                  [ PostgreSQL Database ]

1. Spoofing: Attacker generates fraudulent payment requests pretending to be user 123.
   • Mitigation: Validate cryptographically signed JWT bearer token on every request at the gateway.
2. Tampering: Attacker intercepts HTTP payload and changes amount: 1000 to amount: 1.
   • Mitigation: Enforce TLS 1.3 encryption and calculate server-side pricing directly from product IDs.
3. Repudiation: User claims they never initiated a $5,000 money transfer.
   • Mitigation: Write immutable append-only audit events recording timestamp, IP, User ID, and MFA transaction approval.
4. Information Disclosure: Attacker sniffs credit card numbers in transit or unmasked database logs.
   • Mitigation: Tokenize cards via Stripe Elements; never touch raw PAN (Primary Account Number); mask PII in logs.
5. Denial of Service: Attacker floods checkout endpoint with 100,000 requests/sec.
   • Mitigation: Enforce IP and user-level rate limiting via Redis Sliding Window Lua script.
6. Elevation of Privilege: Standard user passes is_admin: true in request body.
   • Mitigation: Enforce strict DTO schemas (discard extra fields) and derive user roles exclusively from the verified JWT.