Example Threat Model with STRIDE

STRIDE-based threat analysis for the SkyLink Connected Aircraft Platform

Document Information¶

Table of Contents¶

• Document Information
• Table of Contents
• Service Description
  • Overview
  • Functional Decomposition
  • Technical Architecture
  • Component Responsibilities
• Data Dictionary
  • Data Flow Classification
• Threat Actors
  • External Threat Actors
  • Internal Threat Actors
  • Supply Chain Threats
• STRIDE Analysis
  • Spoofing (Identity)
  • Tampering (Integrity)
  • Repudiation (Non-Repudiation)
  • Information Disclosure (Confidentiality)
  • Denial of Service (Availability)
  • Elevation of Privilege (Authorization)
• Risk Matrix
  • Risk Calculation
  • Current Risk Profile
• Threat Scenarios
  • Scenario 1: Data Leak via OAuth Token Exposure
  • Scenario 2: Aircraft Spoofing via mTLS Bypass
  • Scenario 3: Supply Chain Attack
  • Scenario 4: DDoS / API Flood
  • Scenario 5: Replay Attack on Telemetry
• Recommendations Summary
  • Implemented Controls
  • Pending Controls
• Gap Analysis
  • Current State vs Target State
  • Remediation Roadmap
• Review History
• Appendix A: Security Controls Matrix

Service Description¶

Overview¶

SkyLink is a connected aircraft services platform providing real-time telemetry ingestion, weather data, and contact synchronization for commercial aviation. The platform follows Security by Design principles with multi-layer authentication, defense in depth, and privacy by design.

Functional Decomposition¶

The service provides the following capabilities:

• Telemetry Ingestion: Real-time reception of aircraft operational data (speed, altitude, fuel, GPS position)

• Weather Services: Geolocation-based weather and air quality data using external APIs

• Contact Synchronization: Google Contacts retrieval via OAuth 2.0 for crew communication

Technical Architecture¶

                              Internet
                                 │
┌────────────────────────────────┴────────────────────────────────┐
│                      API GATEWAY (:8000)                        │
│  ┌──────────────┐  ┌──────────────┐  ┌──────────────────────┐   │
│  │ Security     │  │ Rate         │  │ JWT RS256 + RBAC     │   │
│  │ Headers      │  │ Limiting     │  │ Authentication &     │   │
│  │ (OWASP)      │  │ (slowapi)    │  │ Authorization        │   │
│  └──────────────┘  └──────────────┘  └──────────────────────┘   │
└─────────────┬──────────────┬──────────────┬─────────────────────┘
              │              │              │
              ▼              ▼              ▼
    ┌─────────────┐  ┌─────────────┐  ┌─────────────┐
    │ TELEMETRY   │  │ WEATHER     │  │ CONTACTS    │
    │ :8001       │  │ :8002       │  │ :8003       │
    └─────────────┘  └─────────────┘  └──────┬──────┘
                                             │
                                             ▼
                                     ┌─────────────┐
                                     │ PostgreSQL  │
                                     │ :5432       │
                                     └─────────────┘

Component Responsibilities¶

Data Dictionary¶

List of data stored or in transit within the service.

Data Flow Classification¶

Threat Actors¶

External Threat Actors¶

Internal Threat Actors¶

Supply Chain Threats¶

STRIDE Analysis¶

Spoofing (Identity)¶

Tampering (Integrity)¶

Repudiation (Non-Repudiation)¶

Information Disclosure (Confidentiality)¶

Denial of Service (Availability)¶

Elevation of Privilege (Authorization)¶

Risk Matrix¶

Risk Calculation¶

Risk = Impact × Likelihood

                │ Low Impact   Medium      High        Maximum
────────────────┼─────────────────────────────────────────────────
Likely          │ MEDIUM       HIGH        CRITICAL    CRITICAL
Possible        │ LOW          MEDIUM      HIGH        CRITICAL
Unlikely        │ LOW          LOW         MEDIUM      HIGH
Rare            │ ACCEPT       LOW         LOW         MEDIUM

Current Risk Profile¶

Threat Scenarios¶

Detailed threat scenarios with business impact analysis.

Scenario 1: Data Leak via OAuth Token Exposure¶

Mitigations Implemented:

• AES-256-GCM encryption for stored tokens

• No token logging (structured logging without PII)

• GitLab/GitHub secrets management

• Gitleaks scanning in CI

Scenario 2: Aircraft Spoofing via mTLS Bypass¶

Mitigations Implemented:

• mTLS with X.509 certificates

• CN ↔ JWT subject cross-validation

• TLS 1.2+ with strong cipher suites

• Certificate generation scripts for proper PKI

Scenario 3: Supply Chain Attack¶

Mitigations Implemented:

• pip-audit for dependency scanning

• Trivy for container scanning

• Cosign for image signing

• SBOM generation (CycloneDX)

• Gitleaks for secret detection

Scenario 4: DDoS / API Flood¶

Mitigations Implemented:

• Rate limiting: 60 requests/minute per aircraft_id

• Global rate limit: 10 requests/second

• Payload size limit: 64KB

• Prometheus metrics for monitoring

Scenario 5: Replay Attack on Telemetry¶

Mitigations Implemented:

• Idempotency via unique (aircraft_id, event_id) constraint

• Response codes: 201 (new), 200 (duplicate), 409 (conflict)

• Server-side timestamps

Recommendations Summary¶

Implemented Controls¶

Pending Controls¶

Gap Analysis¶

Current State vs Target State¶

Remediation Roadmap¶

Review History¶

Appendix A: Security Controls Matrix¶