STRIDE Threat Modeling Explained for the Security+ Exam

STRIDE is a threat modeling framework — a structured way of asking "what could go wrong with this system?" before it is built, rather than discovering the answer afterwards. Developed at Microsoft in the late 1990s, it remains the most widely taught model of its kind.

STRIDE works by turning each security property you want into the threat that violates it, then walking every component of the design against all six.

That inversion is the useful part. Rather than asking the open-ended and unanswerable "how might this be attacked?", you ask six specific questions of every element, and the structure does the remembering for you.

The Six Categories

Threat	Violates	Meaning	Primary defense
Spoofing	Authentication	Pretending to be someone or something else	Strong authentication, MFA, certificates
Tampering	Integrity	Unauthorized modification of data or code	Hashing, digital signatures, access control
Repudiation	Non-repudiation	Denying an action you performed	Secure logging, audit trails, digital signatures
Information disclosure	Confidentiality	Exposing data to those not authorized	Encryption, access control, data minimization
Denial of service	Availability	Making a system unusable	Rate limiting, redundancy, filtering
Elevation of privilege	Authorization	Gaining rights you should not have	Least privilege, input validation, sandboxing

The middle column is the memorization shortcut. Each threat is simply the negation of a security property, and five of the six map onto concepts already familiar from the CIA triad plus authentication and authorization.

How a STRIDE Session Actually Runs

1. Draw the system, usually as a data flow diagram: external entities, processes, data stores, data flows, and — critically — trust boundaries, the lines where data crosses from a less trusted zone to a more trusted one.
2. Walk each element against the six categories. Not every category applies to every element, and that is fine; the discipline is in asking.
3. Record the threats you identify, in concrete terms. "Spoofing" is not a finding. "An attacker could replay a captured session token because tokens have no expiry" is.
4. Rate and prioritize. DREAD was the traditional companion; most teams now use CVSS or a simple likelihood-by-impact matrix.
5. Decide a response for each: mitigate, transfer, accept, or eliminate.
6. Revisit when the design changes. A threat model tied to an architecture from two years ago describes a system that no longer exists.

Trust boundaries deserve emphasis because that is where most real findings cluster. Data crossing from the internet to your application, from the application to the database, from an unprivileged process to a privileged one — those crossings are where the interesting threats live.

STRIDE Among Other Frameworks

Exams may ask you to distinguish these.

• STRIDE — threat categories for design-time modeling. Developer and architecture focused.
• PASTA — Process for Attack Simulation and Threat Analysis. A seven-stage, risk-centric method that ties threats to business impact.
• DREAD — a rating scheme, not a discovery method. Largely superseded.
• MITRE ATT&CK — a catalog of observed adversary tactics and techniques. Operational and detection oriented, not a design-time model.
• Cyber Kill Chain — the stages of an intrusion, useful for framing detection and response.
• OCTAVE — organizational risk assessment rather than system design.

The clean distinction for exam purposes: STRIDE is for designing systems, ATT&CK is for defending running ones.

Strengths and Limits

It is simple enough to teach in an afternoon, comprehensive across the classic threat space, and it catches problems while they are still cheap to fix. Against that: it can produce a large volume of low-value findings if applied mechanically, it depends heavily on the quality of the diagram, it says nothing about business context or likelihood on its own, and it will not find threats outside its six categories — supply chain compromise and many privacy harms sit awkwardly in the model.

Security+ (SY0-701) Exam Tips

• Memorize the acronym and what each letter means. A direct-recall question is likely.
• Map each threat to the property it violates. Spoofing/authentication, tampering/integrity, repudiation/non-repudiation, information disclosure/confidentiality, DoS/availability, elevation of privilege/authorization.
• Given a scenario, name the category. An attacker modifying a transaction in transit is tampering; denying they sent it is repudiation.
• Threat modeling belongs in the design phase of the secure SDLC.
• Know it apart from ATT&CK and the kill chain.

SecurityX and PenTest+ Angles

SecurityX (CAS-005) expects you to run the process, not just name it — building data flow diagrams, identifying trust boundaries, and producing prioritized mitigations for a complex architecture.

PenTest+ (PT0-003) uses threat modeling to scope an engagement: understanding the architecture well enough to target testing where the real risk is rather than testing uniformly.

Key Takeaways

• STRIDE is Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege.
• Each threat is the inverse of a security property, which is the fastest way to remember the set.
• It is a design-time activity, applied to a data flow diagram with explicit trust boundaries.
• Trust boundaries are where the findings cluster.
• It categorizes threats; it does not rate them — pair it with CVSS or a risk matrix.
• STRIDE designs systems; MITRE ATT&CK defends them.

Related reading: Fuzzing · OWASP Top 10