Kamran Mushtaq
Back to Cybersecurity
Cybersecurity

STRIDE

Added: July 27, 2026

Definition

STRIDE is a threat-modeling framework that helps engineers systematically think about six common categories of cyber threats. Instead of guessing what could go wrong, STRIDE provides a checklist so no major threat type is overlooked when securing a system like a CPES.

The Problem That Led to It

Before STRIDE, engineers often relied on experience or intuition to identify threats. This meant important security risks could be forgotten. A missed threat could later become a successful cyberattack. Microsoft developed STRIDE to provide a structured checklist.

What Problem It Solves

STRIDE ensures engineers examine a system from six different attack perspectives:

  • S – Spoofing: Pretending to be someone else.
  • T – Tampering: Changing data or messages.
  • R – Repudiation: Denying an action without proof.
  • I – Information Disclosure: Stealing confidential data.
  • D – Denial of Service (DoS): Making the system unavailable.
  • E – Elevation of Privilege: Gaining higher access than allowed.

What Happens If Not Used

Engineers may focus on only a few attack types while completely missing others, leaving security gaps.

Easy Wording

STRIDE is a security checklist that helps you think of every major way a system could be attacked.

Layman Example

Before opening a shop, the owner checks:

  • Can someone pretend to be an employee? (Spoofing)
  • Can someone change prices? (Tampering)
  • Can someone deny making a purchase? (Repudiation)
  • Can someone steal customer records? (Information Disclosure)
  • Can someone block customers from entering? (DoS)
  • Can someone become the manager without permission? (Elevation of Privilege)

That's exactly how STRIDE helps engineers check a computer system.

Technical Example

Before STRIDE

  • Build a CPES.
  • Think of a few possible attacks.
  • Some threats are accidentally missed.

After STRIDE

  • List all system components (SCADA, RTUs, PLCs).
  • Check each component against all six STRIDE categories.
  • Add security controls for every identified threat.
  • Deploy a more secure system.

Limitation

STRIDE identifies different types of threats, but it does not tell you which threats are the most severe or should be fixed first.

Solution

The next concept is DREAD, a framework that scores and ranks threats by risk, helping engineers decide which vulnerabilities should be addressed first.