Security: Threats & Defense · Study deck
STRIDE Framework
Picture a field unit receiving a software update through a site bridge.
Shield Shelly is your guide for this deck.
After studying this chapter
Learning objectives
You will be able to:
- run the six STRIDE questions across one named trust boundary
- treat a STRIDE label as a starting point, not a finding, until evidence is attached
- apply STRIDE-per-element and STRIDE-per-interaction styles appropriately
- explain why categories overlap and why repudiation is often skipped
Major section
Start Simple: Ask Six Questions at One Boundary
The useful review does not say the whole system is risky.
- Denial of service means preventing a system from doing useful work for its intended users.
- A gateway means a device or service that joins two system paths.
- Telemetry means measurements and status sent for remote use.
Major section
Start Simple: Ask Six Questions at One Boundary (continued)
This runway does not prove that six labels find every threat.
- The deeper sections map spoofing, tampering, repudiation, disclosure, service denial, and excess privilege to boundaries, controls, and evidence.
- STRIDE is easiest when it is not aimed at the whole system.
- The beginner move is to translate each letter into evidence.
Major section
Six Questions Instead of Vague Worry
STRIDE is a memory aid that turns the open-ended question "what could go wrong here?" into six specific questions.
- The six categories are S poofing, T ampering, R epudiation, I nformation disclosure, D enial of service, and E levation of privilege.
- Each question you cannot answer with evidence is a threat worth recording.
Major section
Six Questions Instead of Vague Worry (continued)
If you only need the intuition, this layer is enough: pick one place where data or a command crosses a boundary, then walk the six STRIDE questions in order.
- Think of a guard at a single doorway who works from a fixed checklist instead of a general feeling of unease.
- The same six questions, asked at one IoT boundary, are STRIDE.
- Spoofing asks whether the release service identity is trusted.
Major section
Six Questions Instead of Vague Worry (continued)
Tampering asks whether the package is verified before install.
- Repudiation asks whether approval and install events are attributable.
- Information disclosure asks whether sensitive package metadata or keys are exposed.
- Elevation of privilege asks whether a low-authority operator can trigger an update route.
- Beginner Examples Taken together, these checks make the section reviewable.
Major section
Six Questions Instead of Vague Worry (continued)
That mechanism is the part of Six Questions Instead of Vague Worry the chapter continues to build upon.
- It runs on a boundary STRIDE is applied to a specific crossing point, not to a whole system at once.
- A label is not a finding Writing "S: spoofing" is a sticky note.
- If you can match a scenario to the property it attacks, you have the core idea.
Major section
Walk One Boundary With Evidence
STRIDE earns its value when it is run as an evidence review, not a labeling exercise.
- The Review Sequence Taken together, these checks make the section reviewable.
- Message integrity check, signed update verification, rejected-change event.
- Access limits and encryption in transit and at rest.
- Rate limit, queue behavior, safe fallback, recovery and alert evidence.
Major section
Walk One Boundary With Evidence (continued)
Worked Boundary Review A gateway receives telemetry from devices and forwards accepted readings to a service.
- The packet says devices authenticate to the gateway, but it does not show how accepted telemetry is validated or how command paths are kept separate from telemetry paths.
- Evidence present Spoofing has device authentication evidence at enrollment, so the identity claim has some support.
- Evidence gaps Tampering lacks validation for unexpected message shape; Repudiation lacks accepted-and-rejected event records; Elevation of privilege lacks a denied-command result for telemetry-only identities.
Major section
Properties, Overlap, and Application Style
The deeper layer explains why STRIDE is reliable and where it gets subtle.
- STRIDE as the Dual of the Properties You Want STRIDE is not an arbitrary list.
- This duality is what makes a finding actionable.
- A mismatch, such as proposing encryption (a confidentiality control) to fix an authorization gap, is a sign the category was mislabeled.
Major section
Properties, Overlap, and Application Style (continued)
The goal is coverage of the properties, not a tidy one-threat-one-letter mapping.
- When you label a threat, you are also naming the property to defend, which in turn names the evidence to request and the class of mitigation that fits.
- The categories are review prompts, not mutually exclusive bins.
- Needed function becomes unavailable.
Major section
Properties, Overlap, and Application Style (continued)
That order prevents a control name from being treated as proof and connects the visual to the chapter's evidence-led review sequence.
- Non-repudiation depends on integrity of the log itself, which is why repudiation and tampering frequently appear together.
- Device acts on or runs modified content.
- Telemetry identity reaches a command route.
Major section
Properties, Overlap, and Application Style (continued)
For IoT this matters at command and update paths: if an actuator moved or firmware was approved, the system should be able to attribute that to an identity with a record that resists later tampering.
- Categories Overlap, and That Is Expected A single weakness can sit under more than one category.
- An unauthenticated firmware update path is a Spoofing concern (who is pushing the image), a Tampering concern (was the image altered), and an Elevation of privilege concern (can a low-privilege actor change what runs).
- Common Pitfalls Taken together, these checks make the section reviewable.
Deck summary
Key takeaways
The useful review does not say the whole system is risky.
- This runway does not prove that six labels find every threat.
- STRIDE is a memory aid that turns the open-ended question "what could go wrong here?" into six specific questions.
- If you only need the intuition, this layer is enough: pick one place where data or a command crosses a boundary, then walk the six STRIDE questions in order.
- Tampering asks whether the package is verified before install.
Retrieval practice
Recall check 1 of 3
Shield Shelly says: answer from memory, then check your reasoning.
Q1An attacker connects a rogue device that claims to be a trusted temperature sensor so the gateway accepts its readings. Which STRIDE category fits best?
Show answer
Answer: A Pretending to be a trusted party is spoofing, and the property under attack is authentication.
Retrieval practice
Recall check 2 of 3
Shield Shelly says: answer from memory, then check your reasoning.
Q2A STRIDE review of a gateway command path proves device identity, but shows no evidence that telemetry-only identities are denied command access. What is the best response?
Show answer
Answer: B Proving who a party is does not prove what it is allowed to do.
Retrieval practice
Recall check 3 of 3
Shield Shelly says: answer from memory, then check your reasoning.
Q3Why can a single unauthenticated firmware-update path legitimately raise more than one STRIDE category?
Show answer
Answer: B The path can allow a false pusher, an altered image, and an unauthorized change to running code.
Print reference
Answers
Answer key.
- A · Pretending to be a trusted party is spoofing, and the property under attack is authentication.
- B · Proving who a party is does not prove what it is allowed to do.
- B · The path can allow a false pusher, an altered image, and an unauthorized change to running code.