A container image is trojanised by an attacker by compromising the build server. Based on the STRIDE threat modeling framework, which threat category best defines this threat?

The act of "trojanising" a container image is a direct manipulation and unauthorized modification of its contents. The STRIDE threat modeling framework categorizes threats based on the type of security property violated. In this scenario, the integrity of the container image is compromised. The Tampering category specifically addresses the unauthorized modification of data or code. By injecting malicious code into the image on the build server, the attacker has tampered with the asset, violating its integrity.

A. Repudiation: This threat involves an attacker denying they performed a malicious action. It does not describe the act of modifying the image itself.
B. Spoofing: This involves impersonating another user, component, or entity. While the tampered image might be used to spoof a legitimate service, the core act of modification is tampering.
C. Denial of Service: This threat focuses on making a system or resource unavailable to legitimate users. The modification itself is not a DoS, although the resulting trojan could potentially cause one.

1. Microsoft Documentation: In the official description of the STRIDE model

Tampering is defined as the "modification of data." The scenario describes a modification to the data and code within the container image.

Source: Microsoft

"The STRIDE Threat Model

" Security Development Lifecycle. Section: "Tampering."

2. University Courseware: University security courses define tampering as a violation of integrity. Modifying a container image to include a trojan is a classic example of an integrity violation.

Source: University of Washington

Paul G. Allen School of Computer Science & Engineering. CSE 481D: Systems and Security

Lecture 2: Threat Modeling

Slide 15

"STRIDE

" defines Tampering as "Modification of data (integrity)."

3. Academic Publication: Foundational security literature and academic papers on threat modeling consistently link the unauthorized modification of assets to the threat of tampering.

Source: Shostack

A. (2008). Experiences Threat Modeling at Microsoft. MODSEC. Section 2.1

"STRIDE

" describes Tampering as "If an attacker can change my data

that's a violation of integrity." The container image is the data in this context.