Skip to main content

Quality & Security · Framework

STRIDE threat model worksheet

A one-page STRIDE worksheet for a new service, with the questions that turn a diagram into a list of fixes.

A
Amina Diallo Sample 19 Oct 2026
AppSec Threat modeling

How to run it

  1. Draw the data flow: users, services, stores, trust boundaries.
  2. For every element crossing a boundary, walk the six STRIDE questions.
  3. Record each threat with a likelihood, an impact and a mitigation owner.

The six questions

Threat Ask
Spoofing Can someone pretend to be this user or service?
Tampering Can data be changed in transit or at rest?
Repudiation Could someone deny an action we can't prove?
Information disclosure What leaks if this is read by the wrong party?
Denial of service What happens under 100x traffic?
Elevation of privilege Can a normal user reach admin actions?

The attached CSV is the worksheet itself.