mediumDesignScenarioMidSeniorStaff
Walk me through applying STRIDE to the boundary where our order service calls the payments service over the network.
A STRIDE threat modeling example works best at one boundary, such as order service to payments service: test spoofing, tampering, repudiation, information disclosure, denial of service and elevation of privilege, then attach one concrete mitigation to each.
4 min readUpdated 2026-08-15
Answer
Short answer
Apply STRIDE to one named boundary, not the whole system at once. For an order-to-payments call, check caller authentication, request integrity, auditability, sensitive-data leakage, retry-driven denial of service and over-broad payment privileges.
Keep threat modeling explicit in the answer because that is the concept the interviewer is actually trying to test. A good threat modeling explanation names the trade-off, the failure mode, and the evidence you would use before choosing.
Was this answer helpful?
Likely follow-ups
- Which of these six threats would you prioritise fixing first, and why?
- How does mutual TLS between the two services change which threats on your list are already mitigated?
- What changes in this analysis if the payments service is a third-party API rather than one you own?
- How would you know if this threat model had gone stale six months from now?
Related questions
- You've run a threat model and found real issues, but engineering leadership says the roadmap has no room this quarter. How do you get the fixes prioritised?mediumAlso on threat-modeling and appsec3 min
- How do you know when a threat model has gone stale, and how would you catch it before an incident does?mediumAlso on threat-modeling and appsec4 min
- You are accepting webhooks from two hundred partners. Threat model the ingestion pipeline - what are you actually defending against, and what does the endpoint have to do before it trusts a payload?hardAlso on threat-modeling4 min
- A payment API times out and the client retries. How do you guarantee the customer is not charged twice?hardAlso on distributed-systems6 min