← Years 9–10 Digital Systems

STRIDE threat categories

A memory aid for six threat types: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service and Elevation of privilege. Use it to ask what could go wrong in a system.

Part of: 9-10 Digital Technologies Vic Curric - Digital Systems and Security — Module 75, VCE Software Development - U4O2 - Cyber Security: secure software development practices — Module 76, ACARA Digital Technologies Years 9–10 — Networked Systems and Access Control — Module 144, ACARA Digital Technologies Years 9–10 — Cyber Security Threats and Vulnerabilities — Module 47, WA Computer Science ATAR Year 11 — Network Communications — Module 100, WA Computer Science ATAR Year 11 — Cyber Security — Module 137

Understanding STRIDE threat categories in Years 9–10 Digital Systems

What it does: Repudiation means someone can deny an action because there is no proof, which is why audit trails matter. Denial of service attacks the availability of a system by blocking legitimate users. Spoofing (the S in STRIDE) means pretending to be someone or something else. Tampering is changing data without permission. Information disclosure (I) is when private data is exposed to people who should not see it. It threatens confidentiality. Elevation of privilege (E) means gaining more access than you are allowed. It breaks the principle of least privilege. STRIDE is a memory aid for asking what could go wrong. You apply the six questions to every part of the diagram.

Common mistakes: In STRIDE the letter I stands for Information disclosure, not Integrity. Integrity is the security goal that Tampering threatens. Information disclosure is a threat to confidentiality, because private data is seen by the wrong people. It should be I -> Confidentiality.

Class: _____________________  ·  Name: _____________________  ·  Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add STRIDE threat categories to a class →

This module's key terms are also in a printable crossword (Modules 70–79) and word search (Modules 41–79).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning
Duo
Someone logs in to a school portal pretending to be another student. Which STRIDE category is this?
SpoofingTampering
Matches
I in STRIDE = Integrity, so it is about changing data
↓
The I in STRIDE stands for Information disclosure, which is about leaking private data (confidentiality). Changing data is Tampering.
Applying
Meanings
Term
STRIDE
Meaning
A memory aid for six threat types: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service and Elevation of privilege. Use it to ask what could go wrong in a system.
Practice
S - Spoofing - authentication
Testing
Gaps
S = (pretending to be a user)
Check Answer
Spots
3R = Repudiation
4I = Integrity

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

The 'Stag' badge — Forest Legend, one of Cloodit's 106 collectible badges
Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy
Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games
Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print
Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. Someone logs in to a school portal pretending to be another student. Which STRIDE category is this?
A. Spoofing ✓
B. Tampering
Spoofing (the S in STRIDE) means pretending to be someone or something else. Tampering is changing data without permission.
2. An attacker changes a student's marks in a database without permission. Which STRIDE category fits best?
A. Information disclosure
B. Tampering ✓
Tampering (T) is unauthorised changing of data. It threatens integrity.
3. A user says 'I never sent that message' and the system has no logs to prove otherwise. Which STRIDE threat is this?
A. Spoofing
B. Repudiation ✓
Repudiation (R) means someone can deny an action and nobody can prove it. Access logs and audit trails help prevent it.
4. A misconfigured website shows other customers' addresses to anyone who visits. Which STRIDE category is this?
A. Information disclosure ✓
B. Elevation of privilege
Information disclosure (I) is when private data is exposed to people who should not see it. It threatens confidentiality.
5. Which CIA property is most directly threatened by the D in STRIDE, Denial of service?
A. Availability ✓
B. Confidentiality
Denial of service (D) stops people using a system, so it attacks availability.

Match the Pairs

S in STRIDE → Spoofing: pretending to be someone or something else, such as logging in with a stolen identity
T in STRIDE → Tampering: changing data or code without permission, such as editing a record in a database
A threat where a user denies doing an action and there are no logs to prove otherwise → R = Repudiation
A threat that makes a system too busy or unavailable for real users (availability) → D = Denial of service
I in STRIDE = Integrity, so it is about changing data → The I in STRIDE stands for Information disclosure, which is about leaking private data (confidentiality). Changing data is Tampering.
E in STRIDE = Encryption, a way to fix threats → The E in STRIDE stands for Elevation of privilege, where an attacker gains more access than they should. It is a threat, not a fix.

Key Term

STRIDE
A memory aid for six threat types: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service and Elevation of privilege. Use it to ask what could go wrong in a system.

Fill in the Blanks

1. S = Spoofing (pretending to be a user)
Hint: Type the STRIDE category for pretending to be someone else, such as using another person's login.
2. T = Tampering breaks integrity
Hint: Type the CIA property that is damaged when data is changed without permission.
3. R = Repudiation (denying an action)
Hint: Type the STRIDE category where someone can deny they did something because there is no proof.
4. I = Information disclosure breaks confidentiality
Hint: Type the CIA property that is broken when private data is leaked to the wrong people.
5. D = Denial of service breaks availability
Hint: Type the CIA property that is lost when a system is too overloaded for people to use.

Spot the Error

Question 1
A S = Spoofing
B T = Tampering
C R = Repudiation
D I = Integrity
E D = Denial of service
F E = Elevation of privilege
Line D — In STRIDE the letter I stands for Information disclosure, not Integrity. Integrity is the security goal that Tampering threatens.
Question 2
A S -> Authentication
B T -> Integrity
C I -> Integrity
D D -> Availability
Line C — Information disclosure is a threat to confidentiality, because private data is seen by the wrong people. It should be I -> Confidentiality.
Question 3
A part: Login page
B ask: Can someone fake a user?
C STRIDE: Repudiation
Line C — Pretending to be another user is Spoofing. Repudiation is when someone denies an action they did.
Question 4
A part: Data store
B ask: Can data be read?
C threat: Tampering
Line B — The question must match the Tampering threat, which is about changing data. Asking if data can be read tests for Information disclosure. It should be 'ask: Can data be altered?'.
Question 5
A IF too many requests THEN
B threat <- Repudiation
C harms <- Availability
D END IF
Line B — Flooding a system with too many requests is a Denial of service threat, which harms availability. It is not Repudiation.

Student with a class code? Join your class →