stride-threat-modeling
Compare original and translation side by side
🇺🇸
Original
English🇨🇳
Translation
ChineseSTRIDE Threat Modeling
STRIDE威胁建模
Threat model a system in a structured workshop format.
以结构化研讨会的形式对系统进行威胁建模。
1. Model the System
1. 构建系统模型
Draw the diagram: processes, data stores, data flows, external actors, and trust boundaries (dashed lines where privilege/context changes).
- Every element numbered; technologies noted on processes/stores
- Include the boring parts: auth flows, async jobs, admin tooling, backups
绘制系统图：包含进程、数据存储、数据流、外部参与者以及信任边界（权限/上下文发生变化处用虚线标注）。
- 每个元素编号；进程/存储上标注所使用的技术
- 不要遗漏细节：认证流程、异步任务、管理工具、备份机制
2. Enumerate with STRIDE
2. 用STRIDE枚举威胁
For each element, apply the applicable categories:
| Category | Applies To | Question |
|---|---|---|
| Spoofing | Processes, actors | Can someone pretend to be this? (auth) |
| Tampering | Flows, stores | Can data be modified in transit/at rest? (integrity) |
| Repudiation | Processes | Can actions be denied? (logging/audit) |
| Information disclosure | Flows, stores | Can data leak to unauthorized parties? (confidentiality) |
| Denial of service | Processes, flows | Can this be exhausted or crashed? (availability) |
| Elevation of privilege | Processes | Can rights be gained? (authz) |
Work systematically: element × category grid so nothing is skipped.
为每个元素应用对应的威胁类别：
| 类别 | 适用对象 | 问题 |
|---|---|---|
| Spoofing（仿冒） | 进程、参与者 | 是否有人可以伪装成该对象？（认证层面） |
| Tampering（篡改） | 数据流、存储 | 数据在传输/静态存储时是否可能被修改？（完整性层面） |
| Repudiation（抵赖） | 进程 | 操作是否可能被否认？（日志/审计层面） |
| Information disclosure（信息泄露） | 数据流、存储 | 数据是否可能泄露给未授权方？（保密性层面） |
| Denial of service（拒绝服务） | 进程、数据流 | 该对象是否可能被耗尽资源或崩溃？（可用性层面） |
| Elevation of privilege（权限提升） | 进程 | 是否可能获取更高权限？（授权层面） |
系统化开展工作：通过元素×类别的网格确保无遗漏。
3. Rank
3. 威胁分级
Score each threat by impact (worst realistic outcome) × likelihood (attack complexity, exposure). Prioritize: unauthenticated remote > authenticated remote > local > physical.
根据影响（最严重的实际后果）×可能性（攻击复杂度、暴露程度）为每个威胁打分。优先级排序：未认证远程攻击 > 已认证远程攻击 > 本地攻击 > 物理攻击。
4. Mitigate
4. 缓解措施
For each accepted threat, pick a strategy: reduce (control), transfer, accept (documented, with owner), or avoid (design change). Map mitigations to concrete backlog tickets with acceptance criteria.
针对每个已确认的威胁，选择应对策略：降低风险（控制措施）、转移风险、接受风险（需记录并明确责任人）或规避风险（变更设计）。将缓解措施转化为具体的待办事项，并附带验收标准。
5. Validate
5. 验证
- Review the model when the architecture changes (trigger: new external dependency, new trust boundary, new data class)
- Retro: incidents found in prod vs threats previously modeled — feed misses back into the method
- 当架构发生变化时（触发条件：新增外部依赖、新增信任边界、新增数据类别），重新评审模型
- 回顾：对比生产环境中发现的事件与之前建模的威胁——将遗漏的威胁反馈到方法中
Output
输出成果
System diagram with trust boundaries, element × STRIDE threat grid, ranked risk register, and mitigations as tracked tickets.
包含信任边界的系统图、元素×STRIDE威胁网格、分级风险登记册，以及作为跟踪事项的缓解措施。