STRIDE Threat Model
A six-category framework for enumerating threats: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege.
Definition
STRIDE is a threat-classification taxonomy developed by Microsoft in the late 1990s and now the de-facto threat-modeling vocabulary in medical device cybersecurity. The acronym stands for Spoofing identity, Tampering with data, Repudiation, Information disclosure, Denial of service, and Elevation of privilege - six classes of threat that map onto the security properties of authentication, integrity, non-repudiation, confidentiality, availability, and authorization. STRIDE is used to systematically walk every element of a data-flow diagram and ask, for each, which of the six threat classes apply and how they would be mitigated.What this means in practice
STRIDE shines when paired with a data-flow diagram (DFD) that shows trust boundaries between subsystems. The team walks each element (process, data store, external entity, data flow) across each STRIDE category, recording threats, likelihood/impact, and mitigations. The output feeds the cybersecurity risk assessment and links to ISO 14971 safety harms.Examples
- A healthcare provider accidentally sends patient data to an unauthorized device, raising an 'Information disclosure' threat. Applying STRIDE helps identify controls like access restrictions or encryption to mitigate this risk.
- During a STRIDE analysis of an infusion pump, the team identifies 'Tampering' as a potential threat if an attacker alters the dosage settings wirelessly. This prompts the development of integrity checks and secure communication protocols.
- Evaluating a remote monitoring system, a 'Denial of service' threat is identified if an attacker floods the device with requests, preventing it from sending critical alerts. The team then considers mitigation strategies such as rate limiting or secure network configurations.
- •Applying STRIDE without a current data-flow diagram - there's nothing systematic to walk.
- •Conflating STRIDE categories (e.g., logging Information disclosure threats as Tampering).
- •Stopping at threat enumeration without scoring likelihood/impact and selecting mitigations.
Frequently asked questions
Cross-references
Used by
Related terms
Grouped by themeEditor's picks
· Hand-selected related conceptsA structured analysis that identifies how an attacker could compromise a medical device and what controls mitigate each threat.
The bundle of cybersecurity artifacts a sponsor includes in a 510(k), De Novo, PMA, or HDE submission for a cyber device.
The federal statute that gives FDA explicit premarket authority over cybersecurity for cyber devices.
A documented, risk-based set of processes that build cybersecurity into a medical device across its full lifecycle.
FDA Cybersecurity 101
· From this learning pathA machine-readable inventory of all software components, including open-source and third-party libraries, used to build a medical device.
A globally unique identifier for a publicly disclosed cybersecurity vulnerability.
An industry-standard 0–10 score that quantifies the severity of a software vulnerability.
A lightweight, OWASP-maintained SBOM format designed for application security and supply-chain use cases.
Where this term appears across MedTech Terms.
- FDA Cybersecurity 101Lesson 5 of 11
Latest in MedTech
Sources
3 sourcesEvery citation below opens the original document. Each is graded against our source-tier hierarchy so you can see what rests on binding law versus commentary.
- 1Microsoft Threat Modeling - STRIDETier 4 VerifiedMicrosoftlearn.microsoft.com
- 2FDA Cybersecurity Guidance (Sept 2023)Tier 2 VerifiedFDAfda.gov
- 3MDCG Cybersecurity GuidanceTier 2 VerifiedMDCGhealth.ec.europa.eu
Inline markers like [1] jump to the matching reference above.