tomevault-io Phase 6: Threat Identification (STRIDE)
Objective
Systematically identify threats using the STRIDE methodology against every component, connection, and asset flow documented in previous phases.
STRIDE Categories
S - Spoofing (violates Authentication)
Can identities be faked?
- Authentication bypass, session hijacking, credential theft, certificate forgery
- Where to look: Login endpoints, API authentication, service-to-service auth
T - Tampering (violates Integrity)
Can data or code be modified?
- SQL injection, XSS, man-in-the-middle, config tampering, code injection
- Where to look: Input fields, data in transit, stored data, configuration files
R - Repudiation (violates Non-repudiation)
Can actions be denied?
- Log tampering, missing audit trails, unsigned transactions
- Where to look: Logging infrastructure, audit trails, transaction records
I - Information Disclosure (violates Confidentiality)
Can data leak?
- Data breaches, verbose errors, unencrypted transmission, directory traversal
- Where to look: Error handling, API responses, data flows, storage
D - Denial of Service (violates Availability)
Can availability be impacted?
- DDoS, resource exhaustion, algorithmic complexity, connection pool exhaustion
- Where to look: Public endpoints, resource-intensive operations, queues
E - Elevation of Privilege (violates Authorization)
Can permissions be escalated?
- Privilege escalation, IDOR, missing access controls, role manipulation
- Where to look: Authorization checks, role assignments, admin functions
Per-Element STRIDE Relevance
| Element Type | S | T | R | I | D | E |
|---|---|---|---|---|---|---|
| External entities | X | X | ||||
| Processes/Services | X | X | X | X | X | X |
| Data stores | X | X | X | |||
| Data flows | X | X | X | |||
| Trust boundaries | X | X | X |
Tools Reference
add_threat(threat_source, prerequisites, threat_action, threat_impact, category, severity, likelihood, affected_components, affected_assets, tags)
IMPORTANT: Each text field max 200 characters.
| Parameter | Required | Values |
|---|---|---|
| threat_source | Yes | Who/what (max 200 chars) |
| prerequisites | Yes | Conditions needed (max 200 chars) |
| threat_action | Yes | What they do (max 200 chars) |
| threat_impact | Yes | What happens (max 200 chars) |
| category | No | Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege |
| severity | No | Low, Medium, High, Critical |
| likelihood | No | Unlikely, Possible, Likely, Very Likely |
| affected_components | No | List of component IDs |
| affected_assets | No | List of asset names |
| tags | No | List of tags (max 30 chars each) |
Example:
add_threat(
threat_source="external attacker",
prerequisites="with access to the login endpoint",
threat_action="perform credential stuffing attacks",
threat_impact="unauthorized access to user accounts",
category="Spoofing",
severity="High",
likelihood="Likely",
affected_components=["C001"],
affected_assets=["User Credentials"],
tags=["STRIDE-S", "authentication"]
)
Severity Assessment
| Severity | Criteria |
|---|---|
| Critical | System compromise, regulated data breach, complete auth bypass |
| High | Significant data exposure, privilege escalation, service disruption |
| Medium | Limited data exposure, partial impact, requires specific conditions |
| Low | Minimal impact, difficult to exploit, limited scope |
Likelihood Assessment
| Likelihood | Criteria |
|---|---|
| Very Likely | Trivially exploitable, public knowledge, no special access |
| Likely | Known vector, moderate skill, some access needed |
| Possible | Specific conditions required, moderate skill and access |
| Unlikely | Significant access/skill needed, rarely seen |
Workflow
- Call
get_phase_6_guidance() - For each STRIDE category, analyze every component and data flow
- Add threats with full parameters (source, prereqs, action, impact, category, severity, likelihood)
- Tag threats with STRIDE category and domain (e.g., "STRIDE-S", "authentication")
- Link to components and assets affected
- If AWS: Use
search_documentation()to research service-specific threats - Review coverage with
list_threats()-- ensure all 6 STRIDE categories represented
Completion Criteria
- Threats identified across all 6 STRIDE categories
- Each threat has category, severity, and likelihood
- Threats linked to affected components and assets
- AWS-specific threats included (if applicable)
-
list_threats()shows comprehensive inventory - Call
advance_phase()to proceed to Phase 7
Source: awslabs/threat-modeling-mcp-server — distributed by TomeVault.