The threats to our products
April 1, 1999 — By Loren Kohnfelder and Praerit Garg
The growing use of computer systems to store data critical to businesses, as well as users' personal data, makes them very attractive targets for security attacks. Successful attacks can lead to loss of privacy, disclosure of sensitive data, and disruption or denial of service—losses that can cost millions of dollars. The Microsoft Security Task Force has defined a security threat model that it recommends all Microsoft product teams adopt to secure our products for our customers.
The S.T.R.I.D.E. security threat model should be used by all MS products to identify various types of threats the product is susceptible to during the design phase. Identifying the threats is the first step in a proactive security analysis process. Threats are identified based on the design of the product. The next steps in the process are identifying the vulnerabilities in the implementation and then taking measures to close security gaps.
S.T.R.I.D.E. stands for:
Spoofing of user identity
Tampering with data
Repudiability
Information disclosure (privacy breach)
Denial of Service (D.o.S.)
Elevation of privilege
Some attacks can be very sophisticated and have several steps. In such attacks, one minor break-in leads to another, and eventually substantial system damage is done. In most such cases, one of the links is the weakest, and the security of the entire system typically is no better than its weakest link. Finding and improving such weak links is how threat analysis helps improve the security of our products and services.
This article describes various threat categories in the S.T.R.I.D.E. model and provides examples of vulnerabilities that may be exploited by various kinds of attacks to make a threat a reality. This is intended to help you identify potential vulnerabilities in your product during a security analysis.
Each threat is discussed in the context of Microsoft products, which fall into the following five categories:
|
