STRIDE/DREAD Threat Modeling
STRIDE and DREAD Threat Modeling Methodology · Also known as: threat modeling, security analysis, risk assessment
STRIDE/DREAD Threat Modeling is a Microsoft-developed methodology for systematically identifying and prioritizing security threats in software systems. STRIDE enumerates threat categories (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege), and DREAD scores threats by Damage, Reproducibility, Exploitability, Affected Users, and Discoverability.
Read the full method
Sign in with a free account to read this section.
When to use it
Use STRIDE/DREAD in threat modeling phase (design stage) for systems handling sensitive data (finance, healthcare, auth) or serving critical infrastructure. Essential for compliance (NIST, ISO 27001). Less critical for low-risk systems (public websites, non-sensitive data).
Strengths & limitations
- Systematic: STRIDE checklist ensures no threat category is overlooked
- Quantified: DREAD scoring enables objective prioritization of mitigations
- Collaborative: DFDs and threat lists facilitate security discussions with developers
- Actionable: high-risk threats directly suggest controls (encryption, access control, logging)
- DREAD scoring is subjective; different teams rate same threat differently
- STRIDE categories miss domain-specific threats (e.g., machine learning poisoning)
- DFD creation is manual and error-prone; missing or incorrect flows lead to missed threats
- No guarantee completeness: threat modeling is art + science; creative adversaries find new attacks
Frequently asked
What does each letter in STRIDE represent?
S: Spoofing (identity), T: Tampering (data integrity), R: Repudiation (denying actions), I: Information Disclosure (unauthorized access), D: Denial of Service (availability), E: Elevation of Privilege (authorization bypass). Each represents one threat category to consider.
How do I create a Data Flow Diagram (DFD) for threat modeling?
Identify actors (users), processes (functions), data stores (databases), and data flows (messages). Mark trust boundaries: differences in privilege, authentication, or network zones. DFDs should be granular (process-level) but not overwhelming (1–3 pages).
What is a reasonable DREAD score threshold for mitigation?
Scores > 6/10 are high-risk: require mitigation before release. 4–6 = medium-risk: plan mitigation. < 4 = low-risk: acceptable or defer. But context matters: a low-complexity mitigation for a 5-risk threat may be worth doing immediately.
How often should I re-run threat modeling?
Initial threat modeling during design. Update when: architecture changes significantly, new threat landscape emerges, security incidents occur in similar systems. Annual review as minimum for long-lived products.
Sources
- Shostack, A. (2008). Threat Modeling: Designing for Security. Microsoft Press. ISBN: 0735619913
- Howard, M., & Lipner, S. (2006). The Security Development Lifecycle. Microsoft Press. ISBN: 0735622140
- Schoenfield, B. (2015). Securing the Internet of Things. Apress. ISBN: 1430268271
How to cite this page
ScholarGate. (2026, June 3). STRIDE and DREAD Threat Modeling Methodology. ScholarGate. https://scholargate.app/en/numerical-methods/stride-dread-threat-modeling