The Problem with Freeform Brainstorming
If you ask a room of engineers "what could go wrong with this system?", you will get a random, incomplete list. Someone will mention SQL injection. Someone else will mention DDoS. Nobody will mention repudiation because it is not intuitive. Freeform brainstorming has survivorship bias — you only think of threats you already know about.
Frameworks solve this by giving you a checklist of categories to work through systematically. The most widely used framework is STRIDE, developed at Microsoft in the late 1990s by Loren Kohnfelder and Praerit Garg. Each letter maps to a threat category and the security property it violates.
The STRIDE Categories
| Letter | Threat | Security Property Violated | Plain-Language Description |
|---|---|---|---|
| S | Spoofing | Authentication | Pretending to be someone or something you are not. |
| T | Tampering | Integrity | Modifying data or code without authorization. |
| R | Repudiation | Non-repudiation | Denying you performed an action, with no way to prove otherwise. |
| I | Information Disclosure | Confidentiality | Exposing sensitive data to people who should not see it. |
| D | Denial of Service | Availability | Making a system unavailable to legitimate users. |
| E | Elevation of Privilege | Authorization | Gaining capabilities beyond what you are permitted. |
Concrete Examples Per Category
Spoofing: An attacker intercepts a valid session cookie from an HTTP response (because the app does not set the Secure flag) and replays it to impersonate the victim. The server has no way to distinguish the attacker from the real user.
Tampering: A shopping cart stores the item price in a hidden HTML form field. An attacker modifies the field value from 99.99 to 0.01 before submitting the checkout form. The server trusts the client-supplied price.
Repudiation: An admin deletes a customer record. Because application-level audit logging is disabled, there is no record of who performed the deletion or when. The admin can plausibly deny it.
Information Disclosure: An API endpoint returns a full user object: {"id": 42, "email": "[email protected]", "password_hash": "$2b$12$...", "ssn": "123-45-6789"}. The client only needed the email, but the server returns everything.
Denial of Service: An unauthenticated endpoint accepts a search parameter and runs a full-text database query with no rate limiting. An attacker scripts thousands of requests per second with complex search terms, saturating the database connection pool.
Elevation of Privilege: A standard user discovers that the admin API endpoint /api/admin/users only checks for a valid session token, not for an admin role. They call it directly and gain full user management capabilities.
How to Apply STRIDE in Practice
You apply STRIDE to each element of your architecture diagram — not to the system as a whole. For every process, data store, data flow, and external entity, you ask: "How could this element be Spoofed? Tampered with? Repudiated?" and so on. This per-element approach ensures coverage and prevents you from missing threats that only apply to specific components.