Derived from STRIDE Threat Modelling

STRIDE Threat Canvas

Work through the six STRIDE categories with a live threat and mitigation per category, and export the canvas as a working Excel file.

All templates

In a threat modelling session, once the system diagram is on the table.

What you need and what you get

You'll need

The system or feature being modelled
A threat and mitigation line per category

You'll get

A populated threat canvas, downloadable as PNG or PowerPoint
An Excel canvas carrying exactly what the session produced

STRIDE threat canvas: six categories and the properties they violate

Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service and Elevation of Privilege, each card naming the security property the category violates and holding your threat and mitigation.

Work the canvas one category at a time against a single feature. A category with no credible threat recorded is a decision to accept whatever that category brings, so write that down too.

authentication

integrity

non-repudiation

confidentiality

availability

authorisation

Record a threat in each category and the canvas fills in as you go. Coverage and the open categories appear here.