<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-stride-threat-modeling
description: >-
  Apply STRIDE threat modeling methodology to systematically identify Spoofing, Tampering,
  Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege threats
  across data flow diagrams and system components.
domain: cybersecurity
subdomain: security-architecture
tags:
  - stride
  - threat-modeling
  - dfd
  - trust-boundaries
  - pytm
  - risk-assessment
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---

# Performing STRIDE Threat Modeling

## Overview

STRIDE is a structured threat modeling methodology developed at Microsoft that categorizes
threats into six types. This skill covers building data flow diagrams, applying STRIDE
per-element analysis, scoring threats with DREAD, and generating actionable mitigation plans.

Mode: `[MODE: ARCHITECT]` — Threat modeling and security design.

## Prerequisites

- Data flow diagram or system architecture documentation
- `pytm` for programmatic threat models: `pip install pytm`
- Graphviz for DFD rendering: `apt install graphviz`
- Python 3.10+

## Key Concepts

### STRIDE Categories and Mitigations

| Threat | Definition | Mitigation |
|--------|-----------|------------|
| **S**poofing | Impersonating a user or system | Authentication, certificates, MFA |
| **T**ampering | Modifying data in transit or at rest | Integrity checks, HMAC, digital signatures |
| **R**epudiation | Denying an action occurred | Audit logging, non-repudiation controls |
| **I**nformation Disclosure | Exposing data to unauthorized parties | Encryption, access controls, data classification |
| **D**enial of Service | Making a system unavailable | Rate limiting, redundancy, autoscaling |
| **E**levation of Privilege | Gaining unauthorized access | Least privilege, RBAC, input validation |

### STRIDE Per-Element Applicability

| DFD Element | S | T | R | I | D | E |
|-------------|---|---|---|---|---|---|
| External Entity | ✓ | | | | | |
| Process | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Data Store | | ✓ | | ✓ | ✓ | |
| Data Flow | | ✓ | | ✓ | ✓ | |

### Building a Data Flow Diagram with pytm

```python
#!/usr/bin/env python3
"""Generate a threat model DFD using pytm."""
from pytm import TM, Actor, Boundary, Dataflow, Datastore, Process

tm = TM("Web Application Threat Model")
tm.description = "E-commerce application threat model"
tm.isOrdered = True

# Trust boundaries
internet = Boundary("Internet")
dmz = Boundary("DMZ")
internal = Boundary("Internal Network")
db_zone = Boundary("Database Zone")

# External entities
user = Actor("Customer")
user.inBoundary = internet

# Processes
web_app = Process("Web Application")
web_app.inBoundary = dmz
web_app.sanitizesInput = True
web_app.checksInputBounds = True

api_server = Process("API Server")
api_server.inBoundary = internal
api_server.authenticatesSource = True

# Data stores
user_db = Datastore("User Database")
user_db.inBoundary = db_zone
user_db.isEncryptedAtRest = True

# Data flows
user_to_web = Dataflow(user, web_app, "HTTPS Request")
user_to_web.protocol = "HTTPS"
user_to_web.isEncrypted = True

web_to_api = Dataflow(web_app, api_server, "API Call")
web_to_api.protocol = "gRPC+TLS"
web_to_api.authenticatesDestination = True

api_to_db = Dataflow(api_server, user_db, "SQL Query")
api_to_db.protocol = "TLS"

# Generate: python3 tm.py --dfd | dot -Tpng -o dfd.png
tm.process()
```

### DREAD Scoring

```
DREAD Score = (Damage + Reproducibility + Exploitability + Affected Users + Discoverability) / 5

Scale: 1-10 per dimension
Risk Level:
  Critical: 8-10
  High:     6-7
  Medium:   4-5
  Low:      1-3
```

Example scoring:

```json
{
  "threat": "SQL Injection via search parameter",
  "stride_category": "Tampering",
  "dread": {
    "damage": 9,
    "reproducibility": 8,
    "exploitability": 7,
    "affected_users": 9,
    "discoverability": 8,
    "score": 8.2,
    "risk_level": "Critical"
  }
}
```

## Workflow

### Step 1: Define System Scope

```bash
# Generate DFD from pytm model
python3 tm.py --dfd | dot -Tpng -o dfd.png
python3 tm.py --seq | dot -Tpng -o seq.png
```

### Step 2: Enumerate Threats

```bash
# Run automated STRIDE analysis
node scripts/agent.js --action enumerate --model tm.py

# Generate full threat report
node scripts/agent.js --action report --model tm.py --output threats.json
```

### Step 3: Score and Prioritize

```bash
# Score threats with DREAD
node scripts/agent.js --action score --threats threats.json
```

### Step 4: Map Mitigations

For each threat at HIGH or CRITICAL:

```markdown
| Threat ID | Category | Component | Risk | Mitigation | Owner | Status |
|-----------|----------|-----------|------|------------|-------|--------|
| T-001 | Spoofing | Web App | Critical | Implement MFA | Auth Team | Open |
| T-002 | Tampering | API Flow | High | Add request signing | API Team | Open |
| T-003 | Info Disc | User DB | High | Enable column-level encryption | DBA | Open |
```

## Verification

- [ ] DFD includes all external entities, processes, data stores, and data flows
- [ ] Trust boundaries clearly drawn at network, privilege, and data classification transitions
- [ ] STRIDE applied to every element crossing a trust boundary
- [ ] All HIGH/CRITICAL threats have documented mitigations with owners
- [ ] DREAD scores calculated for prioritization
- [ ] Threat model reviewed by development and security teams
- [ ] Mitigations mapped to implementation tickets

## References

- [Microsoft STRIDE](https://learn.microsoft.com/en-us/azure/security/develop/threat-modeling-tool-threats)
- [OWASP Threat Modeling](https://owasp.org/www-community/Threat_Modeling)
- [pytm Documentation](https://github.com/OWASP/pytm)
