STRIDE: Six Ways Things Go Wrong
The Tiffin team is adding a payment webhook: the provider calls Tiffin to say "order 1043 is paid". Someone asks, "What could go wrong?" and the room goes quiet. Open questions freeze people. A checklist gets them talking. STRIDE is that checklist.
The rule
STRIDE: each letter is a property someone breaks.
| Letter | Threat | Property it breaks |
|---|---|---|
| S | Spoofing: pretending to be someone or something else | Authentication |
| T | Tampering: changing data or code without permission | Integrity |
| R | Repudiation: doing something and being able to deny it | Non-repudiation (accountability) |
| I | Information disclosure: exposing data to the wrong party | Confidentiality |
| D | Denial of service: making the system unavailable | Availability |
| E | Elevation of privilege: gaining rights you should not have | Authorization |
You met most of these properties already: the CIA triad plus authentication, authorization and accountability. STRIDE just turns each one into a question an attacker would ask.
Apply it to one element at a time: a process, a data store, a data flow, or an external party. Each letter prompts a threat; each threat needs a mitigation, a decision to accept it, or a ticket to decide later.
The shortcut
Walk the six letters in order, and for each one say "How could someone ___ this?": spoof, tamper with, deny, leak, block, gain rights through.
S and T
Spoof: anyone could post a fake "paid" message, so verify the provider's signature on each request. Tamper: the amount could be altered, so the signature covers the body and Tiffin compares the amount with its own order record.
The trap is stopping at the first two letters. Repudiation and elevation of privilege are the ones teams forget, and they are often the ones that hurt in an incident review.
Drills
Answer fast — trust the rule.
An attacker sends requests pretending to be Tiffin's payment provider. Which STRIDE threat is this?
A courier marks an order "delivered" and later claims they never did, and there are no logs. Which threat applies?
Which property does elevation of privilege break?
Someone modifies the Tiffin image in the registry after it was tested. Which threat and mitigation match?
Remember
- STRIDE: spoofing, tampering, repudiation, information disclosure, denial of service, elevation of privilege.
- Each letter breaks a property; ask "how could someone ___ this?" for all six.
- Don't stop at S and T; R and E are the ones teams forget.