What is the primary purpose of threat modeling frameworks such as STRIDE?

• A. To systematically identify threats and categorize them for mitigation.
• B. To optimize network bandwidth.
• C. To replace secure coding practices.
• D. To manage software licensing.

Answer: (A)

Threat modeling frameworks like STRIDE help you systematically identify security threats to a system and categorize them so you can plan effective mitigations. By analyzing how a system could be attacked across different areas—such as spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege—you map potential risks to concrete controls. This structured approach ensures threats are considered early in design, across components and data flows, and supports prioritizing fixes based on impact and likelihood rather than relying on ad-hoc remedies. It also aids communication within the team by providing a shared, recognizable taxonomy of threat types. This isn’t about squeezing out bandwidth, replacing secure coding practices, or handling software licensing, but about proactively uncovering and organizing security risks to drive effective defenses.