Research Paper on STRIDE Presented By Kranthi Sekhar Reddy Kolli (002832361) University of Cumberlands Threat Modeling: According to Adam Shostack(2017) Threat modeling is about building models, and using those models to help you think about what’s going to go wrong. There are models implicit in most things. For example, in threat intelligence, you often receive IP addresses, email addresses, and similar “indicators.” Implicit is that you’ll plug those IPs into your firewall or IDS, or block or detect those emails at your mail server. There are also important details rarely discussed: Is your firewall from Palo Alto or Fortinet Each has a different user interface, but each has a way to block an IP address. Threat modeling is essential to becoming proactive and strategic in your operational and application security. Modern threat modeling is agile and integrative, building collaboration between security and other teams. That’s security and development, security and operations, security and all sorts of others. Threat modeling is also essential in moving away from “gut feel” to a disciplined approach to problems (2017). STRIDE: Stride is a systematic way to deal with recognizing our application's advantages and the in all probability threats to them. What resources would we say we are talking about precisely? This would be anything that is put away in a database, CPU influence, and documents situated in a record framework. When you have set aside the opportunity to assess your advantages, you would then be able to start to survey the genuine dangers that issue most to your foundation (Shostack, 2017). The name STRIDE [Hernan 2006] is an acronym based on the initials of the six threat categories: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, and Elevation of privilege. These categories are not mutually exclusive, and complex attacks may involve a combination of them. However, they provide a useful set that non-security experts can use to reason about security threats. Spoofing: Spoofing is an attack in which people (or programs) represent themselves as something other than what they truly are, with the intent of gaining authorized access to resources for which they should be unauthorized. A successful spoofing attack is one that allows an attacker to foil or avoid authentication. Conditions under Which Spoofing Might Occur: Spoofing can occur when the source or destination of a message is not properly trusted (e.g., via authentication), but the requested action in the message is still performed. Spoofing can be successful if the attacking component can steal another component’s identity to appear authentic or if other components do not demand proof of authentication. Spoofing Risks: When considering spoofing attacks, we must think about these general design weaknesses that would allow spoofing to occur: · There is no authentication, or the authentication mechanism has been broken or bypassed. ...