Apply STRIDE to your own lab, category by category

short · 55 min · Objective 1.8

Task

Draw your lab as a data flow diagram with trust boundaries, then apply all six STRIDE categories to each element -- recording 'not applicable, because' rather than leaving blanks.

Steps

  1. Write lab/dfd.md enumerating external entities, processes, data stores and data flows in your lab, and marking every trust boundary.
  2. Create lab/stride.csv with header element,category,threat,applicable,reason,disposition.
  3. Apply all six categories to at least four elements -- 24 rows minimum.
  4. For every row where applicable is no, fill reason. An unexplained blank is indistinguishable from an unconsidered one.
  5. Set disposition on every applicable threat to one of mitigated, transferred, accepted or eliminated, and leave none empty.

Verify

awk -F, 'NR>1 {n++} END {print n" stride row(s)"}' lab/stride.csv
awk -F, 'NR>1 {print $2}' lab/stride.csv | sort -u | wc -l
awk -F, 'NR>1 && $4=="no" && $5=="" {n++} END {print n+0" unexplained N/A"}' lab/stride.csv
awk -F, 'NR>1 && $4=="yes" && $6=="" {n++} END {print n+0" without disposition"}' lab/stride.csv
grep -Ec 'boundary' lab/dfd.md

24 or more rows, all six categories present, zero unexplained not-applicables, zero applicable threats without a disposition, and boundaries marked on the diagram. The count of threats with no disposition is the model's real output.

This is an independent study companion for CompTIA SecurityX CAS-005 and is not produced by or endorsed by CompTIA.