Tools / System Design
Explain STRIDE threat modeling.
Microsoft developed the STRIDE methodology in the late 1990s as a way to standardize the identification of threats across their product line. It offers a mnemonic for identifying security threats in six categories:
- Spoofing: An intruder posing as another user, component, or other system feature that contains an identity in the modeled system.
- Tampering: The altering of data within a system to achieve a malicious goal.
- Repudiation: The ability of an intruder to deny that they performed some malicious activity, due to the absence of enough proof.
- Information Disclosure: Exposing protected data to a user that isn't authorized to see it.
- Denial of Service: An adversary uses illegitimate means to exhaust services needed to provide service to users.
- Elevation of Privilege: Allowing an intruder to execute commands and functions that they aren't allowed to.
More Related questions...
