STRIDE threat categories

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. Someone logs in to a school portal pretending to be another student. Which STRIDE category is this?

A Spoofing

B Tampering

2. An attacker changes a student's marks in a database without permission. Which STRIDE category fits best?

A Information disclosure

B Tampering

3. A user says 'I never sent that message' and the system has no logs to prove otherwise. Which STRIDE threat is this?

A Spoofing

B Repudiation

4. A misconfigured website shows other customers' addresses to anyone who visits. Which STRIDE category is this?

A Information disclosure

B Elevation of privilege

5. Which CIA property is most directly threatened by the D in STRIDE, Denial of service?

A Availability

B Confidentiality

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1S in STRIDE		AThe E in STRIDE stands for Elevation of privilege, where an attacker gains more access than they should. It is a threat, not a fix.
2T in STRIDE		BR = Repudiation
3A threat where a user denies doing an action and there are no logs to prove otherwise		CThe I in STRIDE stands for Information disclosure, which is about leaking private data (confidentiality). Changing data is Tampering.
4A threat that makes a system too busy or unavailable for real users (availability)		DD = Denial of service
5I in STRIDE = Integrity, so it is about changing data		ESpoofing: pretending to be someone or something else, such as logging in with a stolen identity
6E in STRIDE = Encryption, a way to fix threats		FTampering: changing data or code without permission, such as editing a record in a database

Definitions

STRIDE

Fill in the Blanks

Complete each line of code by filling in the missing parts.

S = ________ (pretending to be a user)

T = Tampering breaks _________

R = ___________ (denying an action)

I = Information disclosure breaks _______________

D = Denial of service breaks ____________

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A S = Spoofing

B T = Tampering

C R = Repudiation

D I = Integrity

E D = Denial of service

F E = Elevation of privilege

Question 2

A S -> Authentication

B T -> Integrity

C I -> Integrity

D D -> Availability

Question 3

A part: Login page

B ask: Can someone fake a user?

C STRIDE: Repudiation

Question 4

A part: Data store

B ask: Can data be read?

C threat: Tampering

Question 5

A IF too many requests THEN

B threat <- Repudiation

C harms <- Availability

D END IF

Answer Key

STRIDE threat categories

Section A: Quick Questions

A — Spoofing

B — Tampering

B — Repudiation

A — Information disclosure

A — Availability

Section B: Match the Pairs

S in STRIDE → Spoofing: pretending to be someone or something else, such as logging in with a stolen identity

T in STRIDE → Tampering: changing data or code without permission, such as editing a record in a database

A threat where a user denies doing an action and there are no logs to prove otherwise → R = Repudiation

A threat that makes a system too busy or unavailable for real users (availability) → D = Denial of service

I in STRIDE = Integrity, so it is about changing data → The I in STRIDE stands for Information disclosure, which is about leaking private data (confidentiality). Changing data is Tampering.

E in STRIDE = Encryption, a way to fix threats → The E in STRIDE stands for Elevation of privilege, where an attacker gains more access than they should. It is a threat, not a fix.

Section C: Definitions

STRIDE — A memory aid for six threat types: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service and Elevation of privilege. Use it to ask what could go wrong in a system.

Section D: Fill in the Blanks

S = Spoofing (pretending to be a user)

T = Tampering
breaks integrity

R = Repudiation (denying an action)

I = Information disclosure
breaks confidentiality

D = Denial of service
breaks availability

Section E: Spot the Error

D — In STRIDE the letter I stands for Information disclosure, not Integrity. Integrity is the security goal that Tampering threatens.

C — Information disclosure is a threat to confidentiality, because private data is seen by the wrong people. It should be I -> Confidentiality.

C — Pretending to be another user is Spoofing. Repudiation is when someone denies an action they did.

B — The question must match the Tampering threat, which is about changing data. Asking if data can be read tests for Information disclosure. It should be 'ask: Can data be altered?'.

B — Flooding a system with too many requests is a Denial of service threat, which harms availability. It is not Repudiation.