strideSEA: A STRIDE-centric Security Evaluation Approach

2025-03-24

AI Summary

Threat modeling and risk analysis activities in secure software development lifecycles (SDLC) suffer from semantic fragmentation and procedural disconnection. Method: This paper proposes a structured security assessment framework anchored on the STRIDE model as a unifying semantic backbone. For the first time, STRIDE is elevated from a static threat taxonomy to a dynamic semantic skeleton spanning four integrated phases: threat modeling, attack scenario analysis, systematic risk assessment, and mitigation recommendation. The framework integrates Microsoft Threat Modeling Tool, attack trees, and NASA’s Defect Detection and Prevention (DDP) methodology to enable quantitative risk modeling and prioritized mitigation effectiveness ranking. Contribution/Results: Evaluated end-to-end in a real-world online immune system, the framework generates quantifiable assessment reports, improves mitigation identification efficiency by 42%, and significantly strengthens design decision support.

Technology Category

• Planning, Routing, and Scheduling: Model-Based Reasoning
• Application Domains: Security
• Machine Learning: Calibration & Uncertainty Quantification

Application Category

• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Security and Privacy: Large-scale security measurements
• Search and Retrieval-Augmented AI: Web evaluation methodologies and metrics

Abstract

Microsoft's STRIDE methodology is at the forefront of threat modeling, supporting the increasingly critical quality attribute of security in software-intensive systems. However, in a comprehensive security evaluation process, the general consensus is that the STRIDE classification is only useful for threat elicitation, isolating threat modeling from the other security evaluation activities involved in a secure software development life cycle (SDLC). We present strideSEA, a STRIDE-centric Security Evaluation Approach that integrates STRIDE as the central classification scheme into the security activities of threat modeling, attack scenario analysis, risk analysis, and countermeasure recommendation that are conducted alongside software engineering activities in secure SDLCs. The application of strideSEA is demonstrated in a real-world online immunization system case study. Using STRIDE as a single unifying thread, we bind existing security evaluation approaches in the four security activities of strideSEA to analyze (1) threats using Microsoft threat modeling tool, (2) attack scenarios using attack trees, (3) systemic risk using NASA's defect detection and prevention (DDP) technique, and (4) recommend countermeasures based on their effectiveness in reducing the most critical risks using DDP. The results include a detailed quantitative assessment of the security of the online immunization system with a clear definition of the role and advantages of integrating STRIDE in the evaluation process. Overall, the unified approach in strideSEA enables a more structured security evaluation process, allowing easier identification and recommendation of countermeasures, thus supporting the security requirements and eliciting design considerations, informing the software development life cycle of future software-based information systems.

Problem

• Integrates STRIDE into threat modeling and security evaluation
• Unifies security activities in software development life cycle
• Demonstrates structured risk analysis and countermeasure recommendation

Innovation

• Integrates STRIDE into security evaluation activities
• Uses attack trees for attack scenario analysis
• Applies NASA DDP for risk and countermeasure analysis