How does the Elevation of Privilege card deck structure a group STRIDE session?

## What the deck is Elevation of Privilege is a card game, created by Adam Shostack at Microsoft and published freely, that turns a STRIDE analysis into something a group of engineers can play through in an hour. It exists because a solo analyst staring at a diagram tends to write down the threats they already believe in, while a table of people with cards in their hands has to say something about whatever the deck hands them. ## The six suits The deck has six suits, one per STRIDE category. Each category names a threat and the security property it violates: | Suit | Threat | Property violated | |---|---|---| | S | Spoofing | Authentication | | T | Tampering | Integrity | | R | Repudiation | Non-repudiation | | I | Information Disclosure | Confidentiality | | D | Denial of Service | Availability | | E | Elevation of Privilege | Authorization | That mapping is the vocabulary the whole session runs on, and getting a pairing backwards — calling Repudiation an integrity threat, say — is the fastest way to lose an interviewer. ## What a card actually says A card is not the bare letter. It carries one concrete instance of that category, phrased as something an attacker can do: an attacker can act as another user because credentials are guessable; an attacker can write to a data store the service reads without checking it. Within a suit the ranks run roughly from ordinary to exotic — the low cards are the boring, common versions of the threat and the high cards the more specialized ones. That gradient is deliberate. The boring threats are the ones a room of engineers is too embarrassed to raise unprompted, and a low card makes raising one the correct move rather than a waste of the group's time. ## What you need before you deal A diagram of the system the group agrees on — processes, data stores, external entities, the flows between them, and the trust boundaries those flows cross. Without it the game degenerates into swapping generic attack stories, because a played card has nowhere to land. "An attacker can tamper with data in transit" is a threat only once someone can point at *which* flow, crossing *which* boundary. ## How a hand runs Cards are dealt out to everyone. Play goes around in tricks: someone leads a card, the others follow that suit if they hold it, and the Elevation of Privilege suit is trump. When you play a card you say out loud what threat it finds in the design in front of you, and the group records it against the element or flow it hits. You score a point for the trick and a point for a threat that lands. A card that genuinely does not apply is played with a short statement of why not — and that rejection, written down with its reason, is real output too: it is the difference between "we never considered spoofing on this flow" and "we considered it and here is why it does not apply." ## A worked example A five-person squad models a new refunds service. A low card in the Tampering suit hands one engineer a mundane prompt about modifying a record another component trusts. Played against the diagram, it becomes: a support agent with legitimate console access edits the refund amount after the approval step has run, and the downstream ledger trusts the record. That is an insider with authorized access attacking money — a threat weak enough that nobody would have written it on a whiteboard unprompted, and real enough that the fix (approving the amount, not the record; re-checking at settlement) is worth a ticket. ## What the deck is not It is an elicitation aid, not a risk method and not a design review. It does not rate what it finds, does not choose mitigations, and does not prove coverage: a hand ends when the cards run out, which has nothing to do with whether the model has been examined. It also is not the only way to sweep STRIDE — enumerating each element or each interaction systematically is a different pass with a different completeness claim. The score is a play mechanic to keep people engaged; it measures participation, never the security of the design.