Common STRIDE Patterns and Anti-Patterns

Experience with STRIDE reveals common patterns across different system types. Web applications frequently face spoofing through credential theft, tampering through injection attacks, and information disclosure through verbose errors. APIs commonly experience spoofing through key theft, tampering through replay attacks, and elevation of privilege through broken object-level authorization. Recognizing these patterns accelerates threat identification in similar systems.

Certain anti-patterns indicate STRIDE methodology misuse. Focusing only on external threats misses insider risks across all categories. Considering only technical threats overlooks business logic vulnerabilities. Applying STRIDE only to completed systems misses the opportunity to influence secure design. Treating STRIDE as a one-time exercise rather than an iterative process leaves systems vulnerable to evolving threats.

Successful STRIDE implementation requires balancing thoroughness with practicality. Not every theoretical threat deserves equal attention. Focus on threats relevant to your specific context, technology stack, and threat actors. Use STRIDE to ensure comprehensive threat identification, then apply risk assessment to prioritize mitigation efforts.

STRIDE's enduring value lies in its systematic approach to threat identification. By methodically considering six fundamental threat categories against each system element, teams can identify threats that might otherwise be overlooked. While newer methodologies have emerged, STRIDE remains a cornerstone of threat modeling practice, providing a solid foundation that adapts to evolving technologies and threat landscapes. Master STRIDE, and you'll have a powerful tool for identifying threats in any system you encounter.## PASTA: Process for Attack Simulation and Threat Analysis

While STRIDE excels at systematic threat identification, PASTA (Process for Attack Simulation and Threat Analysis) takes a risk-centric approach that aligns technical threats with business objectives. Developed by Tony UcedaVélez, PASTA provides a seven-stage methodology that bridges the gap between technical security analysis and business risk management. This chapter explores how PASTA's comprehensive approach helps organizations understand not just what threats exist, but which ones truly matter to their business objectives and how to address them effectively.