Threat modelling with STRIDE

Every model in this course so far tells you what to do about a threat you already know about. Threat modelling is the step before that: enumerating threats systematically rather than relying on whoever is in the room having seen that failure before.

STRIDE is the oldest checklist still in wide use, and it earns its place by being memorable. Six categories, each the negation of a property you wanted.

• Spoofing defeats authentication. Someone claims an identity that is not theirs.
• Tampering defeats integrity. Data or code is modified in transit or at rest.
• Repudiation defeats attribution. An actor denies having done something and you cannot prove otherwise.
• Information disclosure defeats confidentiality. Data reaches someone it should not.
• Denial of service defeats availability. A legitimate user cannot get the thing they need.
• Elevation of privilege defeats authorization. Someone does something they were not permitted to do.

The method is mechanical, which is its strength. Draw the components and the flows between them, then walk each element against all six categories and ask what would go wrong. It surfaces the threats nobody would have volunteered, particularly repudiation and denial of service, which teams consistently skip.

1. 1

   Take a concrete flow: a developer's CI job reads a secret and deploys.

   text Copy

   CI runner  ->  1Claw API  ->  vault
        |
        +-------->  deploy target

2. 2

   Walk it. Spoofing: could something other than your CI job present that credential? Tampering: could the deployed artifact be modified between build and deploy? Repudiation: if a bad deploy happens, can you prove which job did it?

3. 3

   Keep going. Information disclosure: does the secret reach the build log? Denial of service: what happens if the API is unavailable during a deploy? Elevation: can a job on a feature branch reach production paths?

STRIDE has real limits and it is worth naming them. It is oriented around a system diagram, so it finds threats to components you drew and says nothing about the ones you left out. It is weak on business-logic abuse, where every step is authorised and the sequence is the attack. And it predates agents entirely, which is why this course pairs it with the lethal trifecta and the OWASP agentic list rather than treating it as sufficient.