How do I perform threat modelling with STRIDE?
Threat modelling finds security flaws at design time, when they are cheapest to fix.
Method
- Diagram the system: actors, processes, data stores, data flows and trust boundaries
- Identify threats per element with STRIDE
- Spoofing identity • Tampering with data • Repudiation (denying an action) • Information disclosure • Denial of service • Elevation of privilege
- Rate by likelihood and impact (for example DREAD or a simple risk matrix)
- Mitigate — authentication, integrity checks, audit logs, encryption, rate limits, least privilege
- Verify with tests and review, and record residual risk with an owner
Example: an upload endpoint — spoofing (stolen session) → MFA and session binding; tampering (malicious file) → type checks and malware scanning; disclosure (guessable URLs) → signed, expiring links; DoS (huge files) → size limits and quotas.
Revisit the model whenever architecture, data flows or integrations change.