Six Ways Systems Get Attacked (STRIDE)

Why this matters

STRIDE (Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege) is Microsoft's category framework for threats. It's not a deep theory — it's a vocabulary that lets a team enumerate threats without skipping classes. The discipline isn't memorising the letters; it's running through them deliberately for each component you ship.

Demo

Apply STRIDE to a POST /api/login endpoint and you immediately surface: Spoofing (credential stuffing), Tampering (injection), Repudiation (no audit), Information disclosure (timing oracle), DoS (rate of brute force), Elevation (post-auth IDOR). Each is a real category of work.

Try it yourself

1. Pick a HTTP endpoint in your codebase. For each STRIDE letter, write one concrete threat that applies.
2. For threats that don't apply, write why (e.g. 'Repudiation: every action goes through an audit log already').
3. Notice which STRIDE classes your codebase routinely under-invests in. That's your roadmap.

References

• Microsoft — STRIDE
• Threat Modeling Manifesto