STRIDE

STRIDE was introduced by Loren Kohnfelder and Praerit Garg in an internal Microsoft paper, "The threats to our products", in April 1999, and was later built into Microsoft's Security Development Lifecycle and its free Threat Modeling Tool. Each letter is the violation of a security property: Spoofing violates authentication, Tampering violates integrity, Repudiation violates non-repudiation, Information disclosure violates confidentiality, Denial of service violates availability, and Elevation of privilege violates authorization. That mapping is the practical value of the model, because each threat category points directly to a family of mitigations: strong authentication and certificate pinning for S, MACs, signatures and access control for T, tamper-evident audit logs for R, encryption and minimisation for I, quotas, rate limits and redundancy for D, and least privilege and input handling for E.

STRIDE is normally applied to a data flow diagram with five element types: external entities, processes, data stores, data flows and trust boundaries. In STRIDE-per-element, only the relevant letters are considered for each type. External entities are subject to S and R; processes to all six; data stores to T, I and D, plus R when the store is an audit log; and data flows to T, I and D. Trust boundaries carry no threats of their own but mark where flows need the most scrutiny. STRIDE-per-interaction instead analyses each flow as a tuple of source, destination and interaction, which produces fewer but more contextual findings, and is the approach the Threat Modeling Tool uses.

The model is a classification and elicitation aid, not a risk rating. Microsoft paired it for a time with DREAD for scoring, but DREAD was dropped because its ratings were too subjective, and teams now usually rate STRIDE findings with CVSS, a simple likelihood and impact matrix or their organisation's risk method. Common misuses are treating the six categories as a complete list, which misses business-logic and abuse cases, and applying STRIDE to a whole system as one box instead of decomposing it. Privacy threats such as linkability or identifiability fall outside STRIDE; LINDDUN was designed as its privacy counterpart, and attack trees or kill-chain models complement it for attacker-centric analysis. Adam Shostack's Elevation of Privilege card game turns the same categories into a structured team exercise.