Chapter 23 — Application and software supply chain security: threat and failure analysis
Lesson map
Lesson 23 published. Map, example, EX067.
flowchart TD
N0["Learning outcomes"]
N1["23.1 STRIDE"]
N2["23.2 Examples"]
N3["23.3 Failure modes"]
N4["23.4 Ranking"]
N5["23.5 Linking to controls"]
N6["23.6 Review"]
N7["Abuse cases"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX067"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["23.1 STRIDE"]
N2["23.2 Examples"]
N3["23.3 Failure modes"]
N4["23.4 Ranking"]
N5["23.5 Linking to controls"]
N6["23.6 Review"]
N7["Abuse cases"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX067"]
[Learning outcomes]
|
v
[23.1 STRIDE]
|
v
[23.2 Examples]
|
v
[23.3 Failure modes]
|
v
[23.4 Ranking]
|
v
[23.5 Linking to controls]
|
v
[23.6 Review]
|
v
[Abuse cases]
|
v
[Worked example] --> [Exercise EX067]
Learning outcomes
You will (1) apply STRIDE to the system model; (2) analyse failure modes of pipeline components; (3) rank threats and failures; (4) link each to controls.
23.1 STRIDE
Shostack (2014) describes STRIDE: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service and Elevation of privilege. Kwame applies it to each element and flow in the model.
Each letter names a property being attacked: spoofing attacks authentication, tampering integrity, repudiation accountability, information disclosure confidentiality, denial of service availability and elevation of privilege authorisation. Walking through the letters for each diagram element gives a structured set of questions, which reduces the chance of forgetting whole categories. Not every letter applies to every element; noting 'not applicable' is still a recorded decision.
23.2 Examples
Spoofing: a fake package with a lookalike name. Tampering: an altered artifact on the mirror. Repudiation: a deployment without a record of who approved it. Information disclosure: secrets in build logs. Denial of service: registry outage stopping builds. Elevation of privilege: a pull request from an untrusted fork gaining access to production secrets.
Each example sits on a specific element of Kwame's diagram, which makes it actionable. The fork pull request is elevation of privilege because it crosses the trust boundary between untrusted contributors and CI secrets. The registry outage is accidental in many cases but is listed because the effect, builds stopped, is the same whether caused by failure or attack.
23.3 Failure modes
Failure mode and effects analysis asks how each component can fail without an attacker: mirror corruption, CI outage, expired signing certificates, clock errors breaking certificate checks.
Accidental failures matter because they cause many real outages and can mimic attacks, as the truncated mirror copy did. An expired signing certificate stops every release; a clock error can make valid certificates look expired. For each failure, the analysis records how it would be noticed and how the system behaves: safely stopping, or carrying on wrongly.
23.4 Ranking
Each threat or failure is rated for likelihood and impact on a 1–3 scale; the product ranks them.
A three-point scale is coarse but quick, and team members agree on it more easily than on finer scales. Multiplying likelihood by impact gives scores from 1 to 9; items scoring 6 or more get attention first. Ties are broken by discussion, with reasons recorded. The scale is not precise risk measurement; it is a way to agree an order of work. Ratings are revisited when controls change, since a new control lowers likelihood and therefore the rank, as the worked example's certificate monitoring will do.
23.5 Linking to controls
Each high-ranked item must have a control and a test. Untracked items are risks recorded for management.
Linking means naming the control that reduces each item and the test that shows it works, as in the requirements table. An item with a control but no test is treated as uncontrolled until tested. Lower-ranked items may be accepted without controls, but the acceptance is recorded with a reason and the name of the person who accepted it. This makes it clear who decided, and it lets the next review check whether the reasoning still holds.
23.6 Review
The analysis is revisited when the architecture changes and after incidents.
Architecture changes add new elements and flows that the old analysis never considered. Incidents show where the analysis was wrong, either missing a threat or misjudging its likelihood. Each review starts from the previous ranking and records what changed and why. Kwame also schedules a yearly review even without changes, since new attack classes appear and the team's own understanding improves. Lessons from the mirror mismatch, for example, raised the likelihood of storage failures in the next review.
Abuse cases
For the most important features, the team writes short abuse cases alongside user stories: how might someone misuse the refund feature or the ticket transfer? Abuse cases guide tests and controls without describing attack techniques in detail. They help product managers understand why some features need extra checks, such as a limit on refunds per day.
Residual risk
Items without full controls are reported to management as accepted or planned risks.
Worked example
Top-ranked items: untrusted fork pull requests reaching secrets (likelihood 2, impact 3), mirror tampering (2, 3) and expired signing certificates stopping releases (3, 2). Controls exist for the first two; for the third, the team adds certificate expiry monitoring with 30 days' warning.
Synthetic case. Ratings are synthetic.
Errors and limits
STRIDE prompts thinking but does not guarantee completeness.
Exercises
- EX067 — STRIDE letters. What does STRIDE stand for? Rubric: 3 = spoofing, tampering, repudiation, information disclosure, DoS, elevation of privilege; 2 = five; 1 = three; 0 = none.
- EX068 — Fork threat. Which STRIDE category is the untrusted fork case? Rubric: 3 = elevation of privilege; 2 = partial; 1 = vague; 0 = none.
- EX069 — New control. What control was added for certificate expiry? Rubric: 3 = monitoring with 30 days' warning; 2 = partial; 1 = vague; 0 = none.
Synthesis
STRIDE and failure analysis turn models into ranked, controlled risks.
Continue studying — chapter 23 of 50
← Chapter 22 (draft) · Course chapter index · Chapter 24 (draft) →