Threat Modeling (STRIDE)

Identify and mitigate architectural security flaws during the design phase, before any code is written.

Methodology: STRIDE

• Spoofing: Impersonating something or someone else. (Mitigation: Strong Authentication)
• Tampering: Modifying data or code. (Mitigation: Integrity checks, TLS)
• Repudiation: Claiming to have not performed an action. (Mitigation: Secure Logging, Auditing)
• Information Disclosure: Exposing information to unauthorized users. (Mitigation: Encryption at rest/transit)
• Denial of Service: Denying or degrading service to users. (Mitigation: Rate limiting, WAF)
• Elevation of Privilege: Gaining capabilities without proper authorization. (Mitigation: RBAC, Least Privilege)

Threat Modeling Process