STRIDE threat model — quick narrative via search
You are designing a new B2B authentication flow using OAuth 2.1 + OIDC + Keycloak. Your security architect wants a fast STRIDE narrative grounded in OWASP and STRIDE-patterns before committing to a full workflow run.
How the gateway answered
Captured 2 July 2026 — a point-in-time run; corpora and tools have been updated since.
Build a STRIDE threat model for the following authentication architecture: user → Keycloak → resource server → PostgreSQL. For each STRIDE category list threats and attack techniques, verification requirements, and control mappings; cite STRIDE patterns, MITRE CAPEC, OWASP, NIST 800-53 where available, and any EU product-security duties (CRA).
search(query="spoofing authentication token replay trust boundary" sources=[stride-patterns])→ 5 threat patterns — STRIDE-API-OAUTH-001, STRIDE-EMAIL-SPF-001, STRIDE-PAYMENT-TOKEN-001, STRIDE-MEDDEV-SPOOF-005, STRIDE-CRYPTO-RANDOM-001search(query="session token replay authentication bypass" sources=[capec])→ 5 MITRE attack patterns via the search_capec_patterns fan-out — CAPEC-114, CAPEC-115, CAPEC-140, CAPEC-196, CAPEC-102 (capec.mitre.org, The MITRE Corporation)search(query="session management verification requirements token" sources=[owasp])→ 2 results — ASVS V3.2.1 (new session token on authentication), WSTG-SESS-01 Objective 2 (session-ID randomness)search(query="access control least privilege authentication" sources=[security-controls])→ 5 catalog controls — IAC-20, CPL-03.3, IAC-21, IAC-16.3, AAT-29.2; no NIST 800-53 identifiers in the returned rowssearch(query="products with digital elements essential cybersecurit…" jurisdictions=[EU])→ 4 results via search + agency-guidance + case-law fan-out — CRA Annex I Part I, MDCG 2025-6, plus 2 off-scope rows (batteries-regulation recital, automotive repair-access guidance)STRIDE threat model — OAuth 2.1 + OIDC + Keycloak authentication flow
Four components in scope: user agent → Keycloak (auth server) → resource server → PostgreSQL. Each STRIDE category below is grounded in one of five gateway searches from this run — the STRIDE threat-pattern library, MITRE CAPEC attack patterns (publisher: The MITRE Corporation, served with capec.mitre.org source links), OWASP verification requirements, the security-controls catalog, and EU product law. A category with no fetched evidence is marked unresolved instead of being filled from model memory.
Spoofing
- Authentication mechanism abuse. CAPEC-114: an attacker "obtains unauthorized access to an application, service or device either through knowledge of the inherent weaknesses of an authentication mechanism" or by exploiting a flaw in it — the umbrella threat over every login path Keycloak exposes.
- Authentication bypass. CAPEC-115: the attacker "gains access to application, service, or device with the privileges of an authorized or privileged user by evading or circumventing an authentication mechanism". This row also grounds Elevation of privilege below.
- Forged session credential. CAPEC-196: "An attacker creates a false but functional session credential in order to gain or usurp access to a service."
- Predictable token generation. Predictable Token …
Every claim traces to a source you can open
A typical AI assistant invents a citation that looks plausible. Ansvar retrieves the real one. Every finding above rests on one of these 17 sources — official legislation, guidance from standards bodies or regulators, threat-pattern libraries, and controls catalog — linked wherever the source is publicly reachable; catalog rows served through the gateway are quoted as fetched. No citation is fabricated — every source was retrieved through Ansvar and can be checked.
- STRIDE patterns — OAuth 2.0 Access Token Theft and Replay in Spring Boot and Express.js Applications (STRIDE-API-OAUTH-001)intl · threat-pattern · served via the gateway
- STRIDE patterns — Email Spoofing via SPF/DKIM/DMARC Bypass (STRIDE-EMAIL-SPF-001)intl · threat-pattern · served via the gateway
- STRIDE patterns — Tokenization Bypass and Token Reuse Attacks (STRIDE-PAYMENT-TOKEN-001)intl · threat-pattern · served via the gateway
- STRIDE patterns — Medical Device Identity Spoofing via Default Credentials and Weak Authentication (STRIDE-MEDDEV-SPOOF-005)intl · threat-pattern · served via the gateway
- STRIDE patterns — Predictable Token Generation via Weak Random Number Generators (STRIDE-CRYPTO-RANDOM-001)intl · threat-pattern · served via the gateway
- MITRE CAPEC-114 — abusing weaknesses of an authentication mechanismintl · threat-pattern · capec.mitre.org
- MITRE CAPEC-115 — evading or circumventing an authentication mechanismintl · threat-pattern · capec.mitre.org
- MITRE CAPEC-140 — bypassing an ordered sequence of web formsintl · threat-pattern · capec.mitre.org
- MITRE CAPEC-196 — forging a false but functional session credentialintl · threat-pattern · capec.mitre.org
- MITRE CAPEC-102 — session sidejacking over unencrypted channelsintl · threat-pattern · capec.mitre.org
- OWASP ASVS 4.0.3 — V3.2.1: new session token on user authenticationintl · guidance · github.com
- OWASP WSTG v4.2 — Testing for Session Management Schema, Objective 2intl · guidance · github.com
- Security controls — IAC-20: Least-privilege logical accessintl · controls-catalog · served via the gateway
- Security controls — IAC-21: Least privilege for processesintl · controls-catalog · served via the gateway
- Security controls — IAC-16.3: Step-up authentication for privilege changesintl · controls-catalog · served via the gateway
- Cyber Resilience Act (Regulation (EU) 2024/2847), Annex I, Part I — Essential cybersecurity requirementseu · regulation · eur-lex.europa.eu
- MDCG 2025-6 — cybersecurity measures required by the AIA and MDR/IVDReu · guidance · health.ec.europa.eu
Run this on your own data
This is available as a service: Threat Model as a Service. Bring your own documents and scope, and we'll run it end-to-end — every finding cited and validated by the expert who delivers it.
Read the full sample deliverable: Sample threat model.