Threat Modeling Language

STRIDE = Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege — a Microsoft framework for categorising security threats.

Threat actors are potential adversaries: nation-state actors, cybercriminals, insiders, script kiddies. Understanding threat actors helps prioritise security controls.

Attack surface includes all externally accessible interfaces, services, APIs, network ports, and code paths — reducing attack surface is a key security principle.

Defence in depth uses multiple security layers (perimeter, network, host, application, data) — an attacker must breach all layers, making compromise significantly harder.

EoP threats involve attackers gaining unauthorised access: a low-privilege user exploiting a bug to gain admin rights, or a web app user accessing another user's data.