Merge pull request #205 from LLM-Coding/copilot/add-stride-anchor

feat: Add STRIDE threat model as a new semantic anchor

Author: rdmueller

docs/anchors/stride.adoc

@@ -0,0 +1,47 @@
+= STRIDE Threat Model
+:categories: testing-quality
+:roles: software-developer, software-architect, qa-engineer, devops-engineer, consultant, team-lead
+:related: owasp-top-10, regulated-environment
+:proponents: Loren Kohnfelder, Praerit Garg, Adam Shostack
+:tags: security, threat-modeling, appsec, risk, threats
+:tier: 3
+
+[%collapsible]
+====
+Full Name:: STRIDE Threat Modeling Framework
+
+Also known as:: STRIDE Threat Model, Microsoft STRIDE
+
+[discrete]
+== *Core Concepts*:
+
+Spoofing:: Impersonating another user, process, or system to gain unauthorized access; mitigated by strong authentication
+
+Tampering:: Unauthorized modification of data in transit or at rest; mitigated by integrity controls, digital signatures, and access controls
+
+Repudiation:: Denying that an action was performed when it actually was; mitigated by audit logging and non-repudiation mechanisms
+
+Information Disclosure:: Exposing sensitive data to unauthorized parties; mitigated by encryption, access control, and data minimization
+
+Denial of Service:: Disrupting or degrading availability of a system or service for legitimate users; mitigated by rate limiting, redundancy, and resilience
+
+Elevation of Privilege:: Gaining capabilities or permissions beyond what is legitimately authorized; mitigated by least-privilege principles and authorization checks
+
+Key Proponents:: Loren Kohnfelder and Praerit Garg (Microsoft, 1999); popularized by Adam Shostack ("Threat Modeling: Designing for Security", 2014)
+
+[discrete]
+== *When to Use*:
+
+* Performing structured threat modeling during software design and architecture reviews
+* Identifying and categorizing potential threats in security assessments
+* Training developers to think adversarially about system security
+* Prioritizing security controls and mitigations during system design
+* Conducting security design reviews and red-team exercises
+* Establishing a shared vocabulary for discussing security threats across teams
+
+[discrete]
+== *Related Anchors*:
+
+* <<owasp-top-10,OWASP Top 10>>
+* <<regulated-environment,Regulated Environment>>
+====

docs/anchors/stride.de.adoc

@@ -0,0 +1,46 @@
+= STRIDE Bedrohungsmodell
+:categories: testing-quality
+:roles: software-developer, software-architect, qa-engineer, devops-engineer, consultant, team-lead
+:related: owasp-top-10, regulated-environment
+:proponents: Loren Kohnfelder, Praerit Garg, Adam Shostack
+:tags: security, threat-modeling, appsec, risk, threats
+
+[%collapsible]
+====
+Vollständiger Name:: STRIDE Bedrohungsmodellierungs-Framework
+
+Auch bekannt als:: STRIDE Bedrohungsmodell, Microsoft STRIDE
+
+[discrete]
+== *Kernkonzepte*:
+
+Spoofing (Identitätsvortäuschung):: Vortäuschung einer anderen Identität (Benutzer, Prozess oder System) zum Erlangen unbefugten Zugriffs; Gegenmaßnahme: starke Authentifizierung
+
+Tampering (Manipulation):: Unbefugte Veränderung von Daten während der Übertragung oder Speicherung; Gegenmaßnahme: Integritätskontrollen, digitale Signaturen und Zugriffskontrollen
+
+Repudiation (Abstreitbarkeit):: Abstreiten, eine Aktion durchgeführt zu haben; Gegenmaßnahme: Audit-Logging und Nicht-Abstreitbarkeitsmechanismen
+
+Information Disclosure (Informationsoffenlegung):: Preisgabe vertraulicher Daten an unbefugte Parteien; Gegenmaßnahme: Verschlüsselung, Zugriffskontrolle und Datensparsamkeit
+
+Denial of Service (Dienstverweigerung):: Beeinträchtigung oder Unterbrechung der Verfügbarkeit eines Systems für legitime Nutzer; Gegenmaßnahme: Rate Limiting, Redundanz und Resilienz
+
+Elevation of Privilege (Rechteausweitung):: Erlangen von Berechtigungen über das legitim zugewiesene Maß hinaus; Gegenmaßnahme: Least-Privilege-Prinzip und Autorisierungsprüfungen
+
+Schlüsselvertreter:: Loren Kohnfelder und Praerit Garg (Microsoft, 1999); verbreitet durch Adam Shostack („Threat Modeling: Designing for Security", 2014)
+
+[discrete]
+== *Wann zu verwenden*:
+
+* Strukturierte Bedrohungsmodellierung während Software-Design und Architektur-Reviews
+* Identifizierung und Kategorisierung potenzieller Bedrohungen bei Sicherheitsbewertungen
+* Schulung von Entwicklern im sicherheitsorientierten Denken über Systembedrohungen
+* Priorisierung von Sicherheitsmaßnahmen und Gegenmaßnahmen beim Systemdesign
+* Durchführung sicherheitsorientierter Design-Reviews und Red-Team-Übungen
+* Schaffung einer gemeinsamen Sprache für die Diskussion von Sicherheitsbedrohungen im Team
+
+[discrete]
+== *Verwandte Anker*:
+
+* <<owasp-top-10,OWASP Top 10>>
+* <<regulated-environment,Reguliertes Umfeld>>
+====

skill/semantic-anchor-translator/references/catalog.md

@@ -42,6 +42,10 @@ Source: https://github.com/LLM-Coding/Semantic-Anchors
 - **Proponents:** International Electrotechnical Commission
 - **Core:** Safety integrity levels for safety-critical systems
 
+### STRIDE Threat Model
+- **Proponents:** Loren Kohnfelder, Praerit Garg (Microsoft), Adam Shostack
+- **Core:** Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege — structured threat categorization for security design
+
 ## Software Architecture
 
 ### Clean Architecture

website/public/data/anchors.json

@@ -2084,6 +2084,38 @@
     "tags": [],
     "filePath": "docs/anchors/ssot-principle.adoc"
   },
+  {
+    "id": "stride",
+    "title": "STRIDE Threat Model",
+    "categories": [
+      "testing-quality"
+    ],
+    "roles": [
+      "software-developer",
+      "software-architect",
+      "qa-engineer",
+      "devops-engineer",
+      "consultant",
+      "team-lead"
+    ],
+    "related": [
+      "owasp-top-10",
+      "regulated-environment"
+    ],
+    "proponents": [
+      "Loren Kohnfelder",
+      "Praerit Garg",
+      "Adam Shostack"
+    ],
+    "tags": [
+      "security",
+      "threat-modeling",
+      "appsec",
+      "risk",
+      "threats"
+    ],
+    "filePath": "docs/anchors/stride.adoc"
+  },
   {
     "id": "swot",
     "title": "SWOT",