Stride Definition

Front 1

STRIDE

Back 1

Spoofing (identity)

Tampering (with data)

Repudiation (threats)

Information (disclosure)

Denial (of service)

Elevation (of privilege)

Front 2

S = Spoofing (identity)

Back 2

This principle requires you to authenticate requests and users accessing a system. Spoofing involves a malicious party falsely identifying itself as another.

Access keys (such as API keys) or signatures via encryption helps remediate this threat.

Front 3

T = Tampering (with data)

Back 3

By providing anti-tampering measures to a system or application, you help provide integrity to the data. Data that is accessed must be kept integral and accurate.

For example, shops use seals on food products.

Front 4

R = Repudiation (threats)

Back 4

This principle dictates the use of services such as logging of activity for a system or application to track.

Front 5

I = Information (disclosure)

Back 5

Applications and services that handle information of multiple users need to be appropriately configured to only show information relevant to the owner.

Front 6

D = Denial (of service)

Back 6

Applications and services use up system resources. These two things should have measures in place so that abuse of the application/service won't result in bringing the whole system down.

Front 7

E = Elevation (of privilege)

Back 7

This is the worst case scenario for an application or service. It means that a user was able to escalate their authorisation to that of a higher level i.e. an administrator. This scenario often leads to further exploitation or information disclosure.