Phase 6: Threat Identification (STRIDE)
Objective
Systematically identify threats using the STRIDE methodology against every component, connection, and asset flow documented in previous phases.
STRIDE Categories
S - Spoofing (violates Authentication)
Can identities be faked?
- Authentication bypass, session hijacking, credential theft, certificate forgery
- Where to look: Login endpoints, API authentication, service-to-service auth
T - Tampering (violates Integrity)
Can data or code be modified?
- SQL injection, XSS, man-in-the-middle, config tampering, code injection
- Where to look: Input fields, data in transit, stored data, configuration files
R - Repudiation (violates Non-repudiation)
Can actions be denied?
- Log tampering, missing audit trails, unsigned transactions
- Where to look: Logging infrastructure, audit trails, transaction records
I - Information Disclosure (violates Confidentiality)
Can data leak?
- Data breaches, verbose errors, unencrypted transmission, directory traversal
- Where to look: Error handling, API responses, data flows, storage
D - Denial of Service (violates Availability)
Can availability be impacted?
- DDoS, resource exhaustion, algorithmic complexity, connection pool exhaustion
- Where to look: Public endpoints, resource-intensive operations, queues
E - Elevation of Privilege (violates Authorization)
Can permissions be escalated?
- Privilege escalation, IDOR, missing access controls, role manipulation
- Where to look: Authorization checks, role assignments, admin functions
Per-Element STRIDE Relevance
| Element Type |
S |
T |
R |
I |
D |
E |
| External entities |
X |
|
X |
|
|
|
| Processes/Services |
X |
X |
X |
X |
X |
X |
| Data stores |
|
X |
|
X |
X |
|
| Data flows |
|
X |
|
X |
X |
|
| Trust boundaries |
X |
X |
|
|
|
X |
Tools Reference
manage_threats(action="add", section="threats", values=THREAT)
Call manage_threats(action="describe", section="threats") first for the exact
contract.
IMPORTANT: Each text field max 200 characters.
| Parameter |
Required |
Values |
| threat_source |
Yes |
Who/what (max 200 chars) |
| prerequisites |
Yes |
Conditions needed (max 200 chars) |
| threat_action |
Yes |
What they do (max 200 chars) |
| threat_impact |
Yes |
What happens (max 200 chars) |
| category |
No |
Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege |
| severity |
No |
Low, Medium, High, Critical |
| likelihood |
No |
Unlikely, Possible, Likely, Very Likely |
| affected_components |
No |
List of component IDs |
| affected_assets |
No |
List of asset names |
| tags |
No |
List of tags (max 30 chars each) |
Example:
manage_threats(
action="add",
section="threats",
values={
"threat_source": "external attacker",
"prerequisites": "with access to the login endpoint",
"threat_action": "perform credential stuffing attacks",
"threat_impact": "unauthorized access to user accounts",
"category": "Spoofing",
"severity": "High",
"likelihood": "Likely",
"affected_components": ["C001"],
"affected_assets": ["User Credentials"],
"tags": ["STRIDE-S", "authentication"]
}
)
Severity Assessment
| Severity |
Criteria |
| Critical |
System compromise, regulated data breach, complete auth bypass |
| High |
Significant data exposure, privilege escalation, service disruption |
| Medium |
Limited data exposure, partial impact, requires specific conditions |
| Low |
Minimal impact, difficult to exploit, limited scope |
Likelihood Assessment
| Likelihood |
Criteria |
| Very Likely |
Trivially exploitable, public knowledge, no special access |
| Likely |
Known vector, moderate skill, some access needed |
| Possible |
Specific conditions required, moderate skill and access |
| Unlikely |
Significant access/skill needed, rarely seen |
Workflow
- Call
manage_workflow(action="guidance", phase="6")
- For each STRIDE category, analyze every component and data flow
- Add threats with full parameters (source, prereqs, action, impact, category, severity, likelihood)
- Tag threats with STRIDE category and domain (e.g., "STRIDE-S", "authentication")
- Link to components and assets affected
- If AWS: Use
search_documentation() to research service-specific threats
- Review coverage with
manage_threats(action="list", section="threats") -- ensure all 6 STRIDE categories represented
Completion Criteria
1---2name: phase-6-threat-identification3description: Phase 6 Threat Identification guide with STRIDE methodology reference. Use when identifying threats, categorizing security issues, applying STRIDE analysis, or assessing threat severity and likelihood.4---56# Phase 6: Threat Identification (STRIDE)78## Objective9Systematically identify threats using the STRIDE methodology against every component, connection, and asset flow documented in previous phases.1011## STRIDE Categories1213### S - Spoofing (violates Authentication)14Can identities be faked?15- Authentication bypass, session hijacking, credential theft, certificate forgery16- **Where to look**: Login endpoints, API authentication, service-to-service auth1718### T - Tampering (violates Integrity)19Can data or code be modified?20- SQL injection, XSS, man-in-the-middle, config tampering, code injection21- **Where to look**: Input fields, data in transit, stored data, configuration files2223### R - Repudiation (violates Non-repudiation)24Can actions be denied?25- Log tampering, missing audit trails, unsigned transactions26- **Where to look**: Logging infrastructure, audit trails, transaction records2728### I - Information Disclosure (violates Confidentiality)29Can data leak?30- Data breaches, verbose errors, unencrypted transmission, directory traversal31- **Where to look**: Error handling, API responses, data flows, storage3233### D - Denial of Service (violates Availability)34Can availability be impacted?35- DDoS, resource exhaustion, algorithmic complexity, connection pool exhaustion36- **Where to look**: Public endpoints, resource-intensive operations, queues3738### E - Elevation of Privilege (violates Authorization)39Can permissions be escalated?40- Privilege escalation, IDOR, missing access controls, role manipulation41- **Where to look**: Authorization checks, role assignments, admin functions4243## Per-Element STRIDE Relevance4445| Element Type | S | T | R | I | D | E |46|---|---|---|---|---|---|---|47| External entities | X | | X | | | |48| Processes/Services | X | X | X | X | X | X |49| Data stores | | X | | X | X | |50| Data flows | | X | | X | X | |51| Trust boundaries | X | X | | | | X |5253## Tools Reference5455### manage_threats(action="add", section="threats", values=THREAT)5657Call `manage_threats(action="describe", section="threats")` first for the exact58contract.5960**IMPORTANT**: Each text field max 200 characters.6162| Parameter | Required | Values |63|---|---|---|64| threat_source | Yes | Who/what (max 200 chars) |65| prerequisites | Yes | Conditions needed (max 200 chars) |66| threat_action | Yes | What they do (max 200 chars) |67| threat_impact | Yes | What happens (max 200 chars) |68| category | No | Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege |69| severity | No | Low, Medium, High, Critical |70| likelihood | No | Unlikely, Possible, Likely, Very Likely |71| affected_components | No | List of component IDs |72| affected_assets | No | List of asset names |73| tags | No | List of tags (max 30 chars each) |7475**Example**:76```77manage_threats(78 action="add",79 section="threats",80 values={81 "threat_source": "external attacker",82 "prerequisites": "with access to the login endpoint",83 "threat_action": "perform credential stuffing attacks",84 "threat_impact": "unauthorized access to user accounts",85 "category": "Spoofing",86 "severity": "High",87 "likelihood": "Likely",88 "affected_components": ["C001"],89 "affected_assets": ["User Credentials"],90 "tags": ["STRIDE-S", "authentication"]91 }92)93```9495### Severity Assessment9697| Severity | Criteria |98|---|---|99| Critical | System compromise, regulated data breach, complete auth bypass |100| High | Significant data exposure, privilege escalation, service disruption |101| Medium | Limited data exposure, partial impact, requires specific conditions |102| Low | Minimal impact, difficult to exploit, limited scope |103104### Likelihood Assessment105106| Likelihood | Criteria |107|---|---|108| Very Likely | Trivially exploitable, public knowledge, no special access |109| Likely | Known vector, moderate skill, some access needed |110| Possible | Specific conditions required, moderate skill and access |111| Unlikely | Significant access/skill needed, rarely seen |112113## Workflow1141151. **Call `manage_workflow(action="guidance", phase="6")`**1162. **For each STRIDE category**, analyze every component and data flow1173. **Add threats** with full parameters (source, prereqs, action, impact, category, severity, likelihood)1184. **Tag threats** with STRIDE category and domain (e.g., "STRIDE-S", "authentication")1195. **Link to components and assets** affected1206. **If AWS**: Use `search_documentation()` to research service-specific threats1217. **Review coverage** with `manage_threats(action="list", section="threats")` -- ensure all 6 STRIDE categories represented122123## Completion Criteria124- [ ] Threats identified across all 6 STRIDE categories125- [ ] Each threat has category, severity, and likelihood126- [ ] Threats linked to affected components and assets127- [ ] AWS-specific threats included (if applicable)128- [ ] `manage_threats(action="list", section="threats")` shows comprehensive inventory129- [ ] Call `manage_workflow(action="advance")` to proceed to Phase 7
awslabs