HackBlue

Labs / Risk and resilience

STRIDE threat model board

Sort twelve threat cards for a clinic booking system into STRIDE categories, then map them to fixes and decide which one gets fixed first.

  • Interactive lab
  • Beginner
  • 5 steps
  • 0 of 5 solved

Goal

A small clinic is launching online booking. The design review has a data flow diagram and twelve threats the team wrote on cards during a workshop.

Sort each card into the STRIDE category it belongs to. The board shows where each card landed, and a card turns red when the security property it breaks belongs to a different category.

Data flow diagramevery flow below crosses a trust boundary
Patient browserInternet
Booking APIApp network
Appointments DBData network
Referral letter bucketCloud storage
Payment providerThird party
Staff admin consoleClinic network
  • 1
    Patient browser → Booking APIHTTPS: book, cancel, upload
  • 2
    Booking API → Appointments DBSQL
  • 3
    Booking API → Referral letter bucketObject storage API
  • 4
    Payment provider → Booking APIPayment webhook
  • 5
    Staff admin console → Booking APIAdmin API
Threat cards0 of 12 placed
  • —
    Someone signs in to the admin console as a receptionist with a password reused from another breach.Staff admin console
  • —
    The API accepts payment webhooks without checking the provider’s signature, so anyone can post “paid”.Booking API
  • —
    A patient edits the price field in the booking request before it reaches the API, and the API trusts it.Patient browser
  • —
    The search box is concatenated into SQL, letting a user rewrite other patients’ appointment rows.Appointments DB
  • —
    A doctor says they never cancelled 40 appointments, and the API records no actor for cancellations.Booking API
  • —
    Admins can edit the audit log that records their own actions.Staff admin console
  • —
    Changing the number in /appointments/1042 returns another patient’s booking.Booking API
  • —
    Referral letters are stored in a bucket that anyone with the URL can read.Referral letter bucket
  • —
    A script books every free slot for the next month, so real patients cannot book.Booking API
  • —
    Huge uploads fill the disk that the API also uses for its database connection logs, and the API stops.Booking API
  • —
    A receptionist account can call the admin endpoint that changes staff roles.Staff admin console
  • —
    The API container runs as root with the Docker socket mounted, so a code bug gives control of the host.Booking API
Board

S · Spoofing (0)

    Can someone pretend to be another user or system?

    T · Tampering (0)

      Can data or code be changed without permission?

      R · Repudiation (0)

        Can someone deny an action because nothing proves it?

        I · Information disclosure (0)

          Can data reach someone who should not see it?

          D · Denial of service (0)

            Can the service be made unavailable?

            E · Elevation of privilege (0)

              Can someone do more than their role allows?

              Steps

              1. 01Sort all twelve threat cards into their STRIDE categories.

                Do this in the workbench above. This step completes itself when the condition is met.

              2. 02Which external element sends data into the API without a person involved? Give its name from the diagram.

              3. 03Which mitigation answers the repudiation cards?

              4. 04What is the right fix for the edited price?

              5. 05With limited time, which card should be fixed first?