For each component in a design, walk through STRIDE. What can an attacker do here? What mitigates it?
Output: ranked risks with owners and dates. Threat modeling is an architecture activity, not a security-team-only chore.
Lesson 2 of 412 min
Threat modeling — STRIDE in practice
Spoofing, Tampering, Repudiation, Info Disclosure, DoS, Elevation of Privilege.
Key takeaways
- ▸STRIDE = six categories to brainstorm against
- ▸Threat modeling belongs in the design phase, not the audit phase