Open cardosec

Case 55ED94 · GRC · L2 Practitioner

Threat Modeling with STRIDE

Practise as: Explain it · Interview · Deep diveLevel: L2 Practitioner

Interview questionWalk me through threat modeling a new service. How do you use STRIDE?

  1. 01 What is it?
  2. 02 How is it abused?
  3. 03 How do you stop it?
Practise this card As Interview As Deep dive
What a strong answer covers

Try it out loud first. Then check yourself:

  1. Ask four questions: what are we building, what can go wrong, what will we do about it, and did we do a good job?
  2. Draw a data-flow diagram and mark trust boundaries; most threats sit where data crosses one.
  3. STRIDE prompts each element: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege.
  4. Turn threats into tracked mitigations or accepted risks with owners, and revisit the model when the design changes.

If the interviewer pushes back

  • Your team ships every week. How do you keep threat modeling from becoming a bottleneck?

Go deeper

More GRC cards

All GRC cards →

cardosec draws a security topic and gives you a clock: explain it out loud with no notes, then see what you covered and what you missed. Free during early access.

Reviewed 2026-10-09