
STRIDE
-------

**Description:**

STRIDE is a collective for a series of vulnerabilities your applications should
cover in order to harden your applications security.

STRIDE stands for:
Spoofing
Tampering 
Repudiation 
Information Disclosure 
Elevation of privilege

**Solution:**

In the context of network security, a spoofing attack is a situation in which one person 
or program successfully masquerades as another by falsifying data and thereby gaining an 
illegitimate advantage. There are a lot of different types of spoofing you have to take
into account for example: TCP/IP, Referer, ID, or Email spoofing. 

For Tampering we recommend to read the following knowledge base items:

- Input validation 
- Input rejection
- Single input validation controls
  
For Repudiation we recommend to read the following knowledge base items:

- Repudiation attacks

For information disclosure we recommend to read the following knowledge base items:

- Verbose error messaging
- Session information is not stored server-side
- Sensitive information transmitted by un-encrypted methods
- Enforce policys for sensitive data processing
- Verify that the session id is never disclosed
- Username enumeration
- Differential analysis 

For Elevation of privilege we recommend to read the following knowledge base items:

- Authentication at a central location
- All authentication controls must fail securely
- Client-side authentication
- Re-authentication
- Privilege escalation
- Principle of least privilege
- Authentication at a central location