lesson
Updated 6 days ago · 2 views
Imagine building a fortress, locking the front gate with steel bars, but completely forgetting that the kitchen has an open back window.
In software engineering, threat modeling is the structured process of finding those hidden weaknesses before attackers do.
How do developers systematically check every possible angle of attack without missing anything?
The STRIDE Framework
In 1999, Microsoft engineers Loren Kohnfelder and Praerit Garg created STRIDE to help developers classify and hunt down every major cyber threat.
STRIDE is a mnemonic where each letter stands for a distinct category of attack that violates a core security goal.
📊An interactive or clean visual card breakdown of the 6 letters in STRIDE: S (Spoofing - Pretending to be someone else), T (Tampering - Altering data/code), R (Repudiation - Denying an action took place), I (Information Disclosure - Leaking private data), D (Denial of Service - Crashing or flooding a system), E (Elevation of Privilege - Gaining unapproved admin rights). Each letter is displayed in a distinct colored circular badge (S in red, T in orange, R in amber, I in blue, D in purple, E in green) alongside its target security property (Authentication, Integrity, Non-repudiation, Confidentiality, Availability, Authorization). Light background (#f8fafc), dark text (#1e2945), responsive card layout.
What does each of these six threats look like when applied to a real digital system?
Unpacking the 6 Threats
Spoofing occurs when an attacker pretends to be a valid user, device, or server by faking credentials like a username, IP address, or email.
Tampering involves maliciously modifying data either in storage (like altering a database record) or in transit across a network.
Repudiation happens when a system lacks proof or audit logs, allowing a user to deny performing an action, such as claiming they never made a purchase.
Information Disclosure is the exposure of private information to unauthorized eyes, such as leaking passwords, health records, or credit card details.