STRIDE is a mnemonic developed by Microsoft for categorizing security threats into six main types:
- S - Spoofing: Impersonating someone or something else (authentication threats)
- T - Tampering: Modifying data or code (integrity threats)
- R - Repudiation: Claiming you didn't do something you actually did (non-repudiation threats)
- I - Information Disclosure: Exposing information to unauthorized parties (confidentiality threats)
- D - Denial of Service: Denying or degrading service to valid users (availability threats)
- E - Elevation of Privilege: Gaining capabilities without proper authorization (authorization threats)
Application Example: For a web login system:
- Spoofing: Attacker uses stolen credentials
- Tampering: Session cookies are modified
- Repudiation: User denies making a transaction
- Information Disclosure: Password database is leaked
- DoS: Login attempts overwhelm the server
- Elevation of Privilege: Regular user gains admin access through exploit
Rewriting in plainer words…
This answer doesn't lend itself to a diagram - it reads best . No credits were charged.
The model's verdict: “”
The interactive diagram is below the answer - jump to diagram ↓
This answer is explained by a shared concept diagram - open →
Tailored explanation · switch back to · ·
Point the redraw: