Security: Threats & Defense · Study deck
STRIDE Framework
Picture a field unit receiving a software update through a site bridge.
Shield Shelly is your guide for this deck.
After studying this chapter
Learning objectives
You will be able to:
- run the six STRIDE questions across one named trust boundary
- treat a STRIDE label as a starting point, not a finding, until evidence is attached
- apply STRIDE-per-element and STRIDE-per-interaction styles appropriately
- explain why categories overlap and why repudiation is often skipped
Major section
Start Simple: Ask Six Questions at One Boundary
The useful review does not say the whole system is risky.
- Denial of service means preventing a system from doing useful work for its intended users.
- A gateway means a device or service that joins two system paths.
- Telemetry means measurements and status sent for remote use.
Major section
Start Simple: Ask Six Questions at One Boundary (continued)
This runway does not prove that six labels find every threat.
- The deeper sections map spoofing, tampering, repudiation, disclosure, service denial, and excess privilege to boundaries, controls, and evidence.
- STRIDE is easiest when it is not aimed at the whole system.
- The beginner move is to translate each letter into evidence.
Major section
Six Questions Instead of Vague Worry
STRIDE is a memory aid that turns the open-ended question "what could go wrong here?" into six specific questions.
- The six categories are S poofing, T ampering, R epudiation, I nformation disclosure, D enial of service, and E levation of privilege.
- Each question you cannot answer with evidence is a threat worth recording.
Major section
Six Questions Instead of Vague Worry (continued)
If you only need the intuition, this layer is enough: pick one place where data or a command crosses a boundary, then walk the six STRIDE questions in order.
- Think of a guard at a single doorway who works from a fixed checklist instead of a general feeling of unease.
- The same six questions, asked at one IoT boundary, are STRIDE.
- Spoofing asks whether the release service identity is trusted.
Major section
Six Questions Instead of Vague Worry (continued)
Tampering asks whether the package is verified before install.
- Repudiation asks whether approval and install events are attributable.
- Information disclosure asks whether sensitive package metadata or keys are exposed.
- Elevation of privilege asks whether a low-authority operator can trigger an update route.
- Beginner ExamplesTaken together, these checks make the section reviewable.
Major section
Six Questions Instead of Vague Worry (continued)
That mechanism is the part of Six Questions Instead of Vague Worry the chapter continues to build upon.
- It runs on a boundarySTRIDE is applied to a specific crossing point, not to a whole system at once.
- A label is not a findingWriting "S: spoofing" is a sticky note.
- If you can match a scenario to the property it attacks, you have the core idea.
Major section
Walk One Boundary With Evidence
STRIDE earns its value when it is run as an evidence review, not a labeling exercise.
- Message integrity check, signed update verification, rejected-change event.
- Access limits and encryption in transit and at rest.
- Rate limit, queue behavior, safe fallback, recovery and alert evidence.
- Signed-update verification and a rejected-change event are the requested evidence.
Major section
Walk One Boundary With Evidence (continued)
Worked Boundary ReviewA gateway receives telemetry from devices and forwards accepted readings to a service.
- The packet says devices authenticate to the gateway, but it does not show how accepted telemetry is validated or how command paths are kept separate from telemetry paths.
- Evidence presentSpoofing has device authentication evidence at enrollment, so the identity claim has some support.
- Missing evidence creates a recorded threat and a matched integrity-control change, not an immediate acceptance.
Major section
Walk One Boundary With Evidence (continued)
Evidence gapsTampering lacks validation for unexpected message shape; Repudiation lacks accepted-and-rejected event records; Elevation of privilege lacks a denied-command result for telemetry-only identities.
- The one-changed-byte retest must show rejection while the safe version and local service remain available.
- The decision is the end of the evidence chain.
- If you can run a boundary, attach evidence, and match a mitigation to the category, you can use STRIDE in practice.
Major section
Properties, Overlap, and Application Style
The deeper layer explains why STRIDE is reliable and where it gets subtle.
- STRIDE as the Dual of the Properties You WantSTRIDE is not an arbitrary list.
- This duality is what makes a finding actionable.
- A mismatch, such as proposing encryption (a confidentiality control) to fix an authorization gap, is a sign the category was mislabeled.
Major section
Properties, Overlap, and Application Style (continued)
The goal is coverage of the properties, not a tidy one-threat-one-letter mapping.
- When you label a threat, you are also naming the property to defend, which in turn names the evidence to request and the class of mitigation that fits.
- The categories are review prompts, not mutually exclusive bins.
- Needed function becomes unavailable.
Major section
Properties, Overlap, and Application Style (continued)
For IoT this matters at command and update paths: if an actuator moved or firmware was approved, the system should be able to attribute that to an identity with a record that resists later tampering.
- Non-repudiation depends on integrity of the log itself, which is why repudiation and tampering frequently appear together.
- Categories Overlap, and That Is ExpectedA single weakness can sit under more than one category.
- Device acts on or runs modified content.
Major section
Properties, Overlap, and Application Style (continued)
An unauthenticated firmware update path is a Spoofing concern (who is pushing the image), a Tampering concern (was the image altered), and an Elevation of privilege concern (can a low-privilege actor change what runs).
- STRIDE-per-Element and STRIDE-per-InteractionThere are two well-established ways to apply STRIDE to a data-flow diagram.
- Per-element is faster and good for breadth; per-interaction is more precise at the boundaries that matter, which suits IoT command, telemetry, and update paths.
- Telemetry identity reaches a command route.
Deck summary
Key takeaways
The useful review does not say the whole system is risky.
- This runway does not prove that six labels find every threat.
- STRIDE is a memory aid that turns the open-ended question "what could go wrong here?" into six specific questions.
- If you only need the intuition, this layer is enough: pick one place where data or a command crosses a boundary, then walk the six STRIDE questions in order.
- Tampering asks whether the package is verified before install.
Retrieval practice
Recall check 1 of 4
Shield Shelly says: answer from memory, then check your reasoning.
Q1A reviewer runs STRIDE on a device update. What should they scope before walking the threat questions?
Show answer
Answer: C STRIDE questions become testable when tied to a specific crossing.
Retrieval practice
Recall check 2 of 4
Shield Shelly says: answer from memory, then check your reasoning.
Q2An attacker connects a rogue device that claims to be a trusted temperature sensor so the gateway accepts its readings. Which STRIDE category fits best?
Show answer
Answer: A Pretending to be a trusted party is spoofing, and the property under attack is authentication.
Retrieval practice
Recall check 3 of 4
Shield Shelly says: answer from memory, then check your reasoning.
Q3A STRIDE review of a gateway command path proves device identity, but shows no evidence that telemetry-only identities are denied command access. What is the best response?
Show answer
Answer: D Proving who a party is does not prove what it is allowed to do.
Retrieval practice
Recall check 4 of 4
Shield Shelly says: answer from memory, then check your reasoning.
Q4Why can a single unauthenticated firmware-update path legitimately raise more than one STRIDE category?
Show answer
Answer: D The path can allow a false pusher, an altered image, and an unauthorized change to running code.
Print reference
Answers
Answer key.
- C · STRIDE questions become testable when tied to a specific crossing.
- A · Pretending to be a trusted party is spoofing, and the property under attack is authentication.
- D · Proving who a party is does not prove what it is allowed to do.
- D · The path can allow a false pusher, an altered image, and an unauthorized change to running code.