Explain threat modeling using STRIDE and provide an example for a trusted attestation service.

• A. STRIDE is a generic risk framework unrelated to security testing.
• B. STRIDE categories are used only for network design, not threat modeling.
• C. STRIDE categories guide threat identification; example: Spoofing to impersonate the TA, Tampering with attestation data, Repudiation of attestation events, Information disclosure of secrets, Denial of Service against attestation service, Elevation of privilege.
• D. Threat modeling is unnecessary for attestation services.

Answer: (C)

Threat modeling with STRIDE helps you systematically identify potential security threats to a trusted attestation service by grouping attack types into six categories: Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege. Spoofing is when an attacker pretends to be a legitimate prover or the attestation service, so strong authentication, hardware-bound keys, and challenge-response protect authenticity. Tampering refers to altering attestation data or responses; ensure data integrity with signatures, secure channels, and tamper-resistant storage. Repudiation involves an attacker denying an action or an attestation event; non-repudiation is achieved with digitally signed attestations and tamper-evident logs. Information Disclosure means secrets or sensitive measurements leak; mitigate through encryption at rest and in transit, strict access control, and minimizing exposed data. Denial of Service targets availability; defend with rate limiting, quotas, and resource isolation. Elevation of Privilege occurs when an attacker gains higher privileges within the attestation system; address with least-privilege access, secure development practices, code signing, and solid boundary protection between components. For example, a trusted attestation service signs a device’s state using a hardware-backed key and includes a fresh nonce to prevent replay. If someone impersonates a prover, spoofing protections stop it; if attestation data is tampered with, signatures reveal it; if an attestation is repudiated, signed records provide proof; if secrets could be exposed, encryption and restricted disclosure protect them; if the service is overwhelmed, rate limiting helps; if privileges are escalated, strict access controls and hardware boundaries prevent it. This approach shows why STRIDE threat categories are used to identify threats in threat modeling for a trusted attestation service.