<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: performing-stride-analysis
description: >-
  Apply STRIDE threat modeling to systematically categorize Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege threats across system components and data flow diagrams.
domain: cybersecurity
subdomain: threat-modeling
tags:
  - stride
  - threat-categorization
  - dfd
  - trust-boundaries
  - dread-scoring
  - pytm
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1190", "T1078", "T1557"]
---

# Performing STRIDE Analysis

## Overview

STRIDE is Microsoft's structured threat modeling framework that categorizes threats into six
types mapped to security properties. This technique covers per-element STRIDE analysis across
data flow diagrams, DREAD scoring for prioritization, and mitigation mapping.

Mode: `[MODE: ARCHITECT]` — Systematic threat categorization and security design.

## Prerequisites

- Data flow diagram or system architecture documentation
- `pytm` for programmatic threat models: `pip install pytm`
- Graphviz for DFD rendering: `apt install graphviz`
- Python 3.10+

## Key Concepts

### STRIDE Categories

| Threat | Security Property | Mitigation Pattern |
|--------|------------------|--------------------|
| **S**poofing | Authentication | MFA, certificates, token validation |
| **T**ampering | Integrity | HMAC, digital signatures, input validation |
| **R**epudiation | Non-repudiation | Audit logging, tamper-proof logs |
| **I**nformation Disclosure | Confidentiality | Encryption, access controls, classification |
| **D**enial of Service | Availability | Rate limiting, autoscaling, circuit breakers |
| **E**levation of Privilege | Authorization | Least privilege, RBAC/ABAC, sandboxing |

### Per-Element Applicability

| DFD Element | S | T | R | I | D | E |
|-------------|---|---|---|---|---|---|
| External Entity | ✓ | | | | | |
| Process | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Data Store | | ✓ | | ✓ | ✓ | |
| Data Flow | | ✓ | | ✓ | ✓ | |

### DREAD Scoring

Score each dimension 1–10, average for final risk:
- **Damage** — How severe is the impact?
- **Reproducibility** — How reliably can it be exploited?
- **Exploitability** — How much skill/effort is needed?
- **Affected Users** — How many users are impacted?
- **Discoverability** — How easy is it to find?

Risk levels: Critical (8–10), High (6–7), Medium (4–5), Low (1–3).

## Workflow

### Step 1: Build Data Flow Diagram

```bash
# Generate DFD from pytm model
python3 tm.py --dfd | dot -Tpng -o dfd.png
python3 tm.py --seq | dot -Tpng -o seq.png
```

### Step 2: Enumerate STRIDE Threats

```bash
# Enumerate threats for all DFD elements
node scripts/agent.js --action enumerate --elements elements.json

# Example elements.json
cat > elements.json << 'EOF'
[
  {"name": "Browser", "type": "external_entity", "crosses_boundary": true},
  {"name": "API Gateway", "type": "process", "crosses_boundary": true},
  {"name": "User DB", "type": "data_store", "crosses_boundary": true},
  {"name": "Browser→API", "type": "data_flow", "crosses_boundary": true}
]
EOF
```

### Step 3: Score with DREAD

```bash
node scripts/agent.js --action score --threats threats.json --output scored.json
```

### Step 4: Generate Mitigation Report

```bash
node scripts/agent.js --action report --threats scored.json --output report.json
```

## Verification

- [ ] DFD includes all external entities, processes, data stores, and data flows
- [ ] Trust boundaries drawn at network, privilege, and classification transitions
- [ ] STRIDE applied to every element crossing a trust boundary
- [ ] DREAD scores calculated for each identified threat
- [ ] All HIGH/CRITICAL threats have documented mitigations with owners
- [ ] Threat model reviewed by development and security teams

## References

- [Microsoft STRIDE](https://learn.microsoft.com/en-us/azure/security/develop/threat-modeling-tool-threats)
- [OWASP Threat Modeling](https://owasp.org/www-community/Threat_Modeling)
- [pytm Documentation](https://github.com/OWASP/pytm)
- [DREAD Risk Model](https://wiki.openssl.org/index.php/Threat_Model)
