1

I know STRIDE (from Microsoft) stands for Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, and Elevation of privilege.

How did Loren Kohnfelder and Prakrit Garg deduce these six threats (neither five nor seven threats, e.g., Sniffing)?

Could someone give me some explanations?

4
  • For your example: "sniffing" is not a harm of itself, and not a threat if it doesn't result in Information Disclosure or empower an active attack. Trying to control sniffing is also a fool's errand. You may hope to minimize erosion, but you can't stop the rain.
    – Ben Voigt
    Apr 10, 2023 at 15:02
  • (Spoofing is also not a harm by itself)
    – Ben Voigt
    Apr 10, 2023 at 15:03
  • Have you looked this up? Have you seen the original paper?
    – schroeder
    Apr 10, 2023 at 15:53
  • Because otherwise the acronym wouldn't make sense.
    – Frittata
    Apr 12, 2023 at 1:52

1 Answer 1

1

Why Kohnfelder and Garg settled on six threat types is a question best answered by them. I haven't found any documents that specifically state why. The Threats to Our Products document only states "The Microsoft Security Task Force has defined a security model that it recommends all Microsoft product teams adopt..."

From various documents, I've concluded that there is a connection between STRIDE, and the CIA and AAA triads. I cannot determine whether that connection is intentional or serendipity. I see the mapping to the two triads as follows:

Spoofing --> Authentication (AAA)
Tampering --> Integrity (CIA)
Repudiation --> Accounting (AAA)
Information Disclosure --> Confidentiality (CIA)
Denial of Service --> Availability (CIA)
Elevation of Privileges --> Authorization (AAA)

I believe addressing these two triads addresses a majority of security threats. The STRIDE Wikipedia page lists out the desired properties but doesn't make the connection to the two triads.

References
STRIDE (Security)
The Threats to Our Products

1
  • 1
    And also note that these are threats to software, not all types of digital threats (like network threats, for which "sniffing" might apply).
    – schroeder
    Apr 10, 2023 at 17:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .