Stride Analysis Patterns

STRIDE Analysis Patterns

Systematic threat identification using the STRIDE methodology.

When to Use This Skill

• Starting new threat modeling sessions
• Analyzing existing system architecture
• Reviewing security design decisions
• Creating threat documentation
• Training teams on threat identification
• Compliance and audit preparation

Core Concepts

1. STRIDE Categories

S - Spoofing       → Authentication threatsT - Tampering      → Integrity threatsR - Repudiation    → Non-repudiation threatsI - Information    → Confidentiality threats    DisclosureD - Denial of      → Availability threats    ServiceE - Elevation of   → Authorization threats    Privilege

2. Threat Analysis Matrix

Templates and detailed worked examples

Full template library lives in references/details.md. Read that file when you need concrete templates for this skill.

Best Practices

Do's

• Involve stakeholders - Security, dev, and ops perspectives
• Be systematic - Cover all STRIDE categories
• Prioritize realistically - Focus on high-impact threats
• Update regularly - Threat models are living documents
• Use visual aids - DFDs help communication

Don'ts

• Don't skip categories - Each reveals different threats
• Don't assume security - Question every component
• Don't work in isolation - Collaborative modeling is better
• Don't ignore low-probability - High-impact threats matter
• Don't stop at identification - Follow through with mitigations