Threat Modeling

Question 1

Describe the STRIDE model

Answer 1

• Spoofing
• Tampering
• Repudiation
• Information disclousre
• Denial of service
• Escalation of privilege

Question 2

Describe spoofing in terms of STRIDE and give an example

Answer 2

• using another users credentials without their knowledge
• simple passwords are vulnerable
• eg date of birth / 4 digit passwords

Question 3

Describe tampering in terms of STRIDE and give an example

Answer 3

• only authorised users should be able to modify a system
• example attacker adding or removing functional elements

Question 4

Describe repudiation in terms of STRIDE and give an example

Answer 4

• attackers want to hide their actions
• example: deleting logs, or by spoofing another user credentials

Question 5

Describe Information disclosure in terms of STRIDE and give an example

Answer 5

• keeping confidential information secure
• example: error messages leaking information

Question 6

Describe Denial of service in terms of STRIDE and give an example

Answer 6

• attackers may want to prevent users from accessing a system
• blackmailing / extorting owners of the system

Question 7

Describe Escalation of privilege in terms of STRIDE and give an example

Answer 7

• the tampering of a system to acquire additional privlieges
• example: spoofing a user or tampering