STRIDE Model¶
Enumerate software threats across Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, and Elevation of privilege against a concrete system model.
Core Idea¶
STRIDE is a threat-enumeration model for systematically asking how a designed system could fail under six adversarial categories: Spoofing identity, Tampering with data or code, Repudiation of actions, Information disclosure, Denial of service, and Elevation of privilege. Analysts apply the categories to processes, data stores, flows, external entities, and especially trust-boundary crossings in a concrete architecture.
The recognition invariant is system model + six threat categories + element-by-element enumeration + plausible threat scenarios + mapped mitigations. STRIDE is a completeness aid for discovery, not a probability, severity, or compliance score.
Scope of Application¶
STRIDE supports software architecture reviews, cloud services, Windows drivers, APIs, distributed systems, identity flows, data pipelines, and security design training. Microsoft incorporates it into threat-modeling guidance and maps categories to counter-properties such as authentication, integrity, confidentiality, availability, authorization, and nonrepudiation.
Physical safety, fraud incentives, privacy harms, supply-chain compromise, and abuse cases may require additional lenses even when individual events can be forced into STRIDE.
Clarity¶
A category is not a scenario. “Tampering” becomes actionable only when the analyst states which data can be changed, where, by whom, through what boundary, and with what consequence.
Repudiation concerns inability to establish responsibility, not merely a user denying something. Elevation of privilege is unauthorized acquisition/use of capabilities, distinct from spoofing another identity even when one attack chain includes both.
Manages Complexity¶
The mnemonic turns an open-ended adversarial brainstorm into a bounded matrix over system elements. It reduces omission risk and gives teams shared vocabulary.
The reduction can create checkbox behavior. Quality still depends on the fidelity of the system model, creativity of scenarios, knowledge of attackers, and follow-through on mitigation.
Abstract Reasoning¶
- Bound the system and assets.
- Draw data flows and trust boundaries.
- Enumerate elements and entry points.
- Apply each STRIDE category to each relevant element.
- Convert category prompts into concrete scenarios.
- Record assumptions, prerequisites, consequences, and existing controls.
- Map mitigations and separately assess risk/priority.
- Validate coverage with abuse cases and other security lenses.
- Revisit the model after architectural change.
Knowledge Transfer¶
The portable structure is exhaustive classification across a modeled surface. The proposed immediate parent is Classification.
Relationships to Other Abstractions¶
Current abstraction STRIDE Model Domain-specific
Parents (1) — more general patterns this builds on
-
STRIDE Model is a kind of Classification Prime
Classification is the proposed immediate parent.
Hierarchy path (1) — routes to 1 parentless root
- STRIDE Model → Classification
Neighborhood in Abstraction Space¶
STRIDE Model sits in a sparse region of the domain-specific corpus (95th percentile for distinctiveness): few abstractions share its structure, so a faithful description tends to retrieve it precisely.
Family — Unclustered & Miscellaneous (1565 abstractions)
Nearest neighbors
- Authentication Failure — 0.80
- Fallacy of the Secure Network — 0.77
- Rate-Limit Absence — 0.76
- End-to-End Principle — 0.76
- Attack Surface — 0.76
Computed from structural-signature embeddings · 2026-09-08