Lesson 1.32: Threat modelling with STRIDE
A risk register lists what can go wrong across the business; threat modelling finds what can go wrong in one system, while it's still a design and changes are cheap. You draw how data flows, mark where it crosses trust boundaries, and walk through each element with STRIDE: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege. In the lab you review the threat model of Northwind's new checkout: its trust boundaries, which threats are still open, which STRIDE category was never considered, and you add the missing threats and mitigations.
16 min
You will learn to
- Explain threat modelling and data flow diagrams
- Identify trust boundaries
- Apply the six STRIDE categories
- Find open threats and gaps in coverage
- Add threats with concrete mitigations
Key terms
- Threat model
- A structured look at a system's design to find what could go wrong and how to prevent it.
- Data flow diagram (DFD)
- Processes, data stores, external entities and the flows between them.
- Trust boundary
- A line where data passes between parts with different levels of trust.
- STRIDE
- Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege.
- Non-repudiation
- Being able to prove who did something, e.g. with audit logs or signatures.
← Why it matters: lessons from real incidents · All lessons · Reviewing a design before it's built →