The four questions are the whole method. What is being built? Draw it: the components, the data, where it flows, where trust changes hands. What can go wrong? Walk the diagram and ask, at each arrow and each box, how an attacker would abuse it. What will be done about it? Decide, for each threat, whether to fix the design, add a control, accept it or move the risk elsewhere. Was it done well? Come back after building and check. Everything else in the discipline, the checklists and the diagrams and the tools, is scaffolding for those four.
| STRIDE category | The question it prompts | A typical finding |
|---|---|---|
| Spoofing | Can someone pretend to be a user or a component? | A service that trusts any caller on the internal network |
| Tampering | Can data be altered in transit or at rest? | A price sent from the browser and trusted by the server |
| Repudiation | Can someone deny having done something? | No log of who approved a payment |
| Information disclosure | Can data leak to someone who should not see it? | An error message that prints the database query |
| Denial of service | Can the system be made unavailable? | An endpoint that does expensive work for unauthenticated callers |
| Elevation of privilege | Can someone gain rights they should not have? | An admin flag stored in the user's own session token |
The checklist exists because the second question is hard to answer from a blank page. Given a diagram and six categories, a team that has never done this before will find real threats in the first session; without the categories they will find the two they already worried about and stop. The findings are then ranked by how bad and how likely, which is the risk assessment in miniature, and each becomes a design change, a control, or an accepted risk with a name against it. The practice is examined in the security architecture domains of the management credentials and in the secure-development sections of the developer ones, and it is among the rare security activities that cost nothing but attention.