Threat modeling with STRIDE
On This Lesson 4 topics
This lesson is planned. The outline below lists the topics it will cover. The full lesson has not been published yet.
In this lesson
find threats systematically with a data-flow diagram.
Planned topics
- A data-flow diagram (DFD) shows actors, processes, data stores, data flows, and trust boundaries.
- STRIDE: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege.
- Apply STRIDE to each element and each flow that crosses a trust boundary.
- Four questions: what are we building, what can go wrong, what do we do about it, did we do enough.
- Keep the model small and versioned in Git next to the code.
Draft outline details
Demonstration
DFD of Shop: browser → gateway → orders → PostgreSQL / Kafka; trust boundary at the gateway. Table: element, STRIDE letter, threat, mitigation.
Check your understanding
Which STRIDE letter is "a user denies placing an order"?
Show answer
Repudiation.
Practice
Apply this lesson with the module's lab, exercises and quiz.
Marking a lesson complete is optional and you can undo it any time. Your progress stays in this browser.