Week: 2 Graded: Yes Time estimate: 60-75 minutes Tools: Browser (worksheet only; no software installation required)
Learning objective
Apply the STRIDE threat categories to the same system from Lab 1. Produce a structured list of threats organized by STRIDE category. This is the lighter precursor to Lab 6 (the full threat model with diagram); the goal here is vocabulary practice and identifying which categories produce the most threats for your system. (Bloom's L1: Remember -- name all six STRIDE categories; L2: Understand -- explain which CIA property each STRIDE category violates.)
Setup
No software installation. Bring your Lab 1 deliverable: you will use the system description and threat list you wrote there.
Step-by-step instructions
Step 1: STRIDE reference table (5 min)
Copy this table into your document. You will fill the Threats column for your system.
| STRIDE category | Threatened property | One-line description | Threats for your system |
|---|---|---|---|
| Spoofing | Authentication | Pretending to be someone or something you are not | |
| Tampering | Integrity | Modifying data or code without authorization | |
| Repudiation | Non-repudiation | Performing an action and later denying it | |
| Information disclosure | Confidentiality | Accessing data you are not authorized to see | |
| Denial of service | Availability | Preventing legitimate users from accessing the system | |
| Elevation of privilege | Authorization | Gaining access beyond your authorization level |
Step 2: Populate the threats column (30 min)
For each STRIDE category, write 1-2 specific threats for your chosen system. Use the system description from Lab 1 as your reference.
Be specific. "Someone could spoof a user" is not a threat; "An attacker could log in using a stolen session cookie because the application does not validate session IP addresses" is a threat.
For each threat you write, note: is this threat currently mitigated by a control in the system? If you don't know whether a control exists, write "unknown."
Step 3: Priority sort (15 min)
Review your completed threat table. Pick the three threats you believe are the highest-priority for the system's operators to address. For each of the three:
- Name the threat and its STRIDE category.
- Explain in one sentence why it is high-priority (what bad outcome follows if it is not addressed, and how likely you believe that outcome is given what you know about the system).
- Note one mitigation that would reduce the risk (not eliminate it; be realistic about trade-offs).
Step 4: Reflection (10 min)
Write 100-150 words answering: which STRIDE category produced the most threats for your system? Does this surprise you? Is there one STRIDE category where you couldn't identify any threats? If so, why do you think that is?
Deliverable
Your completed STRIDE table plus the priority sort and reflection. Submit as text or PDF. Keep the total under 500 words outside the table.
Grading rubric
| Criterion | Points | Notes |
|---|---|---|
| STRIDE table: at least one specific threat per category | 36 | 6 points per category; "specific" means a named mechanism or scenario, not a category restatement |
| Control status noted for each threat (mitigated / unknown) | 12 | Even "unknown" scores; blank does not |
| Priority sort: three threats with outcome and mitigation | 36 | Must include all three elements for each; 12 points each |
| Reflection: addresses which category dominated and why | 16 | Genuine engagement with the "why" scores; pure description does not |
| Total | 100 |
picoCTF connection
The Forensics category this week often involves files with hidden data or metadata. STRIDE's Information Disclosure category is directly relevant: metadata in files (EXIF data in images, author fields in PDFs, embedded git history in exported archives) is a common source of unintended information disclosure. As you work through the picoCTF Forensics challenges, notice which STRIDE category each challenge exercises. Document the connection in your lab notebook.
Lab 2 of 9. Next: Lab 3 (Crypto warm-up, Week 4).