Typorithm · medium

Threat Modeling (STRIDE)

threat-modelingsecuritystridethreat-modelattack-surface

Saved on this device

Full lesson · 8 learning steps Open any exercise for focused practice

Step 1 of 8 · intro card

Learn Threat Modeling (STRIDE)

Foundations

STRIDE enumerates six threat categories — Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege — each with a mitigation. Threat modeling applies them early by mapping assets, data flows, and trust boundaries.

Threat modeling is the practice of finding what can go wrong before attackers do. You identify assets, draw a data-flow diagram, mark the trust boundaries data crosses, and then enumerate threats against each element.

STRIDE is a checklist of six threat types that pairs each with a defense: Spoofing (counter with authentication), Tampering (integrity checks), Repudiation (audit logging), Information disclosure (encryption), Denial of service (rate limiting), and Elevation of privilege (least privilege).

Done during design, threat modeling is far cheaper than reacting to incidents. It turns vague worry into a concrete list of threats and the specific controls that mitigate them.

STRIDE = six threat categories, each with a mitigation.

Model assets, data flows, and trust boundaries.

Threat-model early, in design, not after launch.

stride:
  spoofing: authenticate-identities
  tampering: integrity-checks
  repudiation: audit-logging
  info_disclosure: encryption
  denial_of_service: rate-limiting
  elevation_of_privilege: least-privilege

Read the implementation

Connect each part of the code to the concept before you type.

1. Spoofing

Spoofing is impersonating another identity; strong authentication mitigates it.

spoofing: authenticate-identities

2. Tampering

Tampering is unauthorized modification; integrity checks like hashes and signatures detect it.

tampering: integrity-checks

3. Repudiation

Repudiation is denying an action; tamper-evident audit logs provide non-repudiation.

repudiation: audit-logging

4. Info disclosure

Information disclosure is leaking data; encryption protects it in transit and at rest.

info_disclosure: encryption

5. Elevation of privilege

Elevation of privilege is gaining rights you should not have; least privilege limits the blast radius.

elevation_of_privilege: least-privilege

A complete learning loop

Understand

Read the concept map and follow the code breakdown.

Reconstruct

Type the implementation, repair mistakes and work through every recall exercise.

Verify

Use the final check without hints; revisit weak concepts in short practice sessions.