Chapter 3: Threat Modeling on Paper

3.2 STRIDE in six plain threats

By Ravindra Bagale · Last updated: 3 October 2026

STRIDE is six words. Each word is a kind of threat. For each one, remember a picture and a fix. Do not memorise a procedure.

1. Spoofing. Someone uses another person's login. The payment API believes the wrong human. Fix: prove identity before the API trusts the caller. A password field on the screen is not proof by itself if the server never checks it.
2. Tampering. Data is changed on the way or in the store. Picture a payment amount of 1000 quietly changed to 1. Fix: do not trust the number that arrived from the client. The server re-checks the amount it already knows, and a signature such as HMAC can show that the body still matches what a trusted sender approved.
3. Repudiation. Someone says "I didn't do it," and you cannot answer, because logs are missing. Fix: keep a record of who asked for the payment and what amount the server accepted. A missing log is the threat. The fix is the log, not a louder argument.
4. Information disclosure. Private data leaks. Picture Aadhaar numbers or card numbers shown where they should not be. Fix: do not place full secrets in screens, tickets, or casual logs. Protect the store that holds them.
5. Denial of service. A flood of fake requests keeps real users out. Fix: limit how much one caller can send, so the payment API still has room for honest traffic. This page will not describe how to create a flood.
6. Elevation of privilege. A normal user becomes an admin. Fix: the server decides the role. It does not accept "I am admin" as a flag from the phone.

Say the six pictures once, slowly. Spoofing is a mask. Tampering is a changed number. Repudiation is a missing diary. Information disclosure is a secret in the open. Denial of service is a crowd at the door. Elevation of privilege is a borrowed crown.

HMAC, in one teaching sentence: it is a signature made with a secret the attacker should not have, so a quiet edit no longer matches. This chapter does not show how to build that signature or how to forge one.