Mapping STRIDE threats to confidentiality, integrity and availability

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. Which part of the CIA triad does a tampering threat mainly attack?

A Availability

B Integrity

2. A denial of service attack floods a school website so students cannot log in. Which part of CIA is attacked?

A Availability

B Confidentiality

3. An attacker pretends to be a teacher to log in to the school portal. Which STRIDE threat is this, and which CIA part does it attack?

A Spoofing attacks confidentiality

B Spoofing attacks availability

4. A hacker leaks a list of student home addresses. Which STRIDE threat is this?

A Tampering

B Information disclosure

5. True or false: Each STRIDE threat attacks at least one part of the CIA triad.

A True

B False

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1Tampering → Integrity		AInformation disclosure → Confidentiality
2Denial of service → Availability		BFlooding or crashing a system so real users cannot get to it when they need it
3Spoofing pretends to be someone else to get into an account and see private data, so it attacks confidentiality		CChanging data without permission, so it can no longer be trusted as accurate
4Information disclosure leaks private data to people who should not see it, so it attacks confidentiality		DSpoofing → Confidentiality
5Tampering → Availability		ETampering changes data, so it attacks integrity, not availability. The fix is Tampering → Integrity.
6Denial of service → Confidentiality		FDenial of service stops people using a system, so it attacks availability, not confidentiality. The fix is Denial of service → Availability.

Definitions

STRIDE maps to CIA

Fill in the Blanks

Complete each line of code by filling in the missing parts.

Spoofing -> _______________

_________ -> Integrity

Denial of service -> ____________

Information disclosure -> _______________

Spoofing -> Confidentiality STRIDE threats map to the ___ triad

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A tampering = "Availability"

B dos = "Availability"

C print(tampering, dos)

Question 2

A spoofing = "Confidentiality"

B tampering = "Integrity"

C dos = "Integrity"

D print(tampering, dos)

Question 3

A if threat == "Tampering":

B goal = "Integrity"

C elif threat == "DoS":

D goal = "Confidentiality"

Question 4

A if threat == "Disclosure":

B goal = "Confidentiality"

C elif threat == "Tampering":

D goal = "Availability"

Question 5

A threat = "Spoofing"

B goal = "Availability"

C print(threat, "->", goal)

Answer Key

Mapping STRIDE threats to confidentiality, integrity and availability

Section A: Quick Questions

B — Integrity

A — Availability

A — Spoofing attacks confidentiality

B — Information disclosure

A — True

Section B: Match the Pairs

Tampering → Integrity → Changing data without permission, so it can no longer be trusted as accurate

Denial of service → Availability → Flooding or crashing a system so real users cannot get to it when they need it

Spoofing pretends to be someone else to get into an account and see private data, so it attacks confidentiality → Spoofing → Confidentiality

Information disclosure leaks private data to people who should not see it, so it attacks confidentiality → Information disclosure → Confidentiality

Tampering → Availability → Tampering changes data, so it attacks integrity, not availability. The fix is Tampering → Integrity.

Denial of service → Confidentiality → Denial of service stops people using a system, so it attacks availability, not confidentiality. The fix is Denial of service → Availability.

Section C: Definitions

STRIDE maps to CIA — Each STRIDE threat attacks at least one part of the CIA triad. Tampering hits integrity, denial of service hits availability, spoofing and information disclosure hit confidentiality.

Section D: Fill in the Blanks

Spoofing -> Confidentiality

Tampering -> Integrity

Denial of service -> Availability

Information disclosure -> Confidentiality

Spoofing -> Confidentiality
STRIDE threats map to the CIA triad

Section E: Spot the Error

A — Tampering means changing data without permission, so it attacks integrity. The line should be tampering = "Integrity". Availability is the part of the CIA triad that denial of service attacks.

C — Denial of service stops people from using a system, so it attacks availability. The line should be dos = "Availability".

D — A denial of service (DoS) attack floods or crashes a system so users cannot reach it. That attacks availability, not confidentiality. The line should be goal = "Availability".

D — Tampering alters data, so it attacks integrity. The line should be goal = "Integrity". Availability is attacked by denial of service.

B — Spoofing is pretending to be someone else to get access to private data, so it attacks confidentiality. The line should be goal = "Confidentiality".