STRIDE worksheet List the elements of your data-flow diagram. The worksheet asks the STRIDE questions that apply to each element type, suggests where to look in SP 800-53, and flags flows that cross a trust boundary.
Sheet TL-102 Rev A Updated November 4, 2026
The rules the worksheet applies Which threats apply to which element type follows Figure 5 of Hernan, Lambert, Ostwald and Shostack, Uncover Security Design Flaws Using The STRIDE Approach
Element S T R I D E External entity xSpoofing applies Tampering does not apply xRepudiation applies Information disclosure does not apply Denial of service does not apply Elevation of privilege does not apply Process xSpoofing applies xTampering applies xRepudiation applies xInformation disclosure applies xDenial of service applies xElevation of privilege applies Data store Spoofing does not apply xTampering applies Repudiation does not apply xInformation disclosure applies xDenial of service applies Elevation of privilege does not apply Data flow Spoofing does not apply xTampering applies Repudiation does not apply xInformation disclosure applies xDenial of service applies Elevation of privilege does not apply
Candidate controls per category (editorial) Category Property Where to look in SP 800-53 Spoofing Authentication IA-2 Identification and Authentication (Organizational Users) IA-3 Device Identification and Authentication IA-5 Authenticator Management IA-8 Identification and Authentication (Non-organizational Users) IA-9 Service Identification and Authentication SC-23 Session Authenticity Tampering Integrity SI-7 Software, Firmware, and Information Integrity SC-8 Transmission Confidentiality and Integrity SI-10 Information Input Validation AC-3 Access Enforcement AU-9 Protection of Audit Information Repudiation Non-repudiation AU-2 Event Logging AU-3 Content of Audit Records AU-10 Non-repudiation AU-12 Audit Record Generation AU-9 Protection of Audit Information Information disclosure Confidentiality SC-8 Transmission Confidentiality and Integrity SC-28 Protection of Information at Rest AC-3 Access Enforcement AC-4 Information Flow Enforcement SC-4 Information in Shared System Resources SI-11 Error Handling Denial of service Availability SC-5 Denial-of-service Protection SC-6 Resource Availability CP-9 System Backup CP-10 System Recovery and Reconstitution Elevation of privilege Authorization AC-3 Access Enforcement AC-6 Least Privilege AC-6(10) Prohibit Non-privileged Users from Executing Privileged Functions SC-39 Process Isolation SI-10 Information Input Validation
The threat-to-property pairs follow the same article (Figure 3). The prompts and candidate controls are our editorial judgment, not NIST guidance. Control titles are from SP 800-53 Rev. 5 (OSCAL 5.2.0).
Worked example Example data-flow diagram for a document upload service An external Customer sends files over flow F1 across a dashed trust boundary to the Upload API process. The API writes to the Document store over flow F2 and sends a message on flow F3 to the Scanner process, which reads the store over flow F4. Flow F1 crosses the trust boundary. Customer EXTERNAL ENTITY TRUST BOUNDARY Upload API Scanner Document store F1 F2 F3 F4 Worked example: a document upload service. Drawing: IT Security Architect, original. The example loads the document upload service from the guide STRIDE threat modeling, with a worked example : one external entity, two processes, one data store and four flows, one of which crosses the trust boundary. That yields 29 element-threat pairs.
Questions or corrections: info@itsecurityarchitect.com .