STRIDE

STRIDE is Microsoft’s threat classification model, used during threat modeling to make sure no category of attack is overlooked. The letters stand for Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, and Elevation of privilege. Analysts walk through each component and data flow of a design asking whether any of the six threat types applies, turning an open-ended brainstorm into a disciplined checklist.

The mapping that matters is threat to violated property. Spoofing violates authentication; Tampering violates integrity; Repudiation violates non-repudiation; Information disclosure violates confidentiality; Denial of service violates availability; Elevation of privilege violates authorisation. Learn the pairs in both directions, because questions quote either side: an attacker forging another user’s identity is spoofing, and the property spoofing defeats is authentication, countered by strong credentials and mutual authentication.

Exam relevance: if a scenario describes a threat and asks for the STRIDE category or the security property involved, translate through the mapping above (deleting logs to hide actions is repudiation; a normal user gaining admin rights is elevation of privilege). The confusable is DREAD, Microsoft’s companion model: STRIDE categorises what a threat is, DREAD scores how bad it is (Damage, Reproducibility, Exploitability, Affected users, Discoverability). Category questions want STRIDE; ranking and rating questions want DREAD or a risk-centric framework such as PASTA.