Integrating STRIDE Threat Modeling into the Prototyping Lifecycle of a Vocational Student Showcase Platform
DOI:
https://doi.org/10.62712/ijapset.v1i2.13Keywords:
Prototyping, Role-based access control, Secure by design, STRIDE, Threat modelingAbstract
Student project showcase platforms in vocational higher education are usually built by small teams through rapid prototyping, and security is often deferred until after deployment. This study integrated STRIDE threat modeling into the prototyping lifecycle of the showcase platform of the D4 Software Engineering Technology program at Politeknik Negeri Medan, a CodeIgniter 4 and MySQL application with role-based access control that held 237 student accounts and 213 project records. Two activities were inserted between quick design and prototype construction: data flow diagram decomposition with STRIDE elicitation, and the derivation of security requirements prioritized by CVSS v3.1 base scores and mapped to the OWASP Top 10:2025 categories. The process produced 17 threats across all six STRIDE categories and 16 security requirements, and every threat was traced to at least one requirement and one allocated control. Three threats were rated Critical and six High, concentrated in authentication, injection, file upload, and access control. Twelve of the 16 requirements were met by built-in framework or platform mechanisms, while the remaining requirements concerned ownership, publication state, data minimization, and auditing. The resulting model offers a reproducible pattern for small academic platforms with high public visibility and frequent developer turnover.
Downloads
References
[1] J. B. Ulven and G. Wangen, "A systematic review of cybersecurity risks in higher education," Future Internet, vol. 13, no. 2, p. 39, 2021, doi: https://doi.org/10.3390/fi13020039.
[2] N. S. Fouad, "Securing higher education against cyberthreats: from an institutional risk to a national policy challenge," Journal of Cyber Policy, vol. 6, no. 2, pp. 137-154, 2021, doi: https://doi.org/10.1080/23738871.2021.1973526.
[3] M. Zaidan, F. Noeraini, Z. Sari, and D. R. Akbi, "Website vulnerability analysis of AB and XY office in East Java," Jurnal Ilmiah Teknik Elektro Komputer dan Informatika, vol. 9, no. 2, pp. 455-492, 2023, doi: https://doi.org/10.26555/jiteki.v9i2.26183.
[4] C. Darmawan, J. P. P. Naibaho, and A. De Kweldju, "Penerapan metode vulnerability assessment untuk identifikasi keamanan website berdasarkan OWASP ID tahun 2021," Edumatic: Jurnal Pendidikan Informatika, vol. 8, no. 1, pp. 272-281, 2024, doi: https://doi.org/10.29408/edumatic.v8i1.25834.
[5] K. Abdulghaffar, N. Elmrabit, and M. Yousefi, "Enhancing web application security through automated penetration testing with multiple vulnerability scanners," Computers, vol. 12, no. 11, p. 235, 2023, doi: https://doi.org/10.3390/computers12110235.
[6] M. Albahar, D. Alansari, and A. Jurcut, "An empirical comparison of pen-testing tools for detecting web app vulnerabilities," Electronics, vol. 11, no. 19, p. 2991, 2022, doi: https://doi.org/10.3390/electronics11192991.
[7] J. Shahid, M. K. Hameed, I. T. Javed, K. N. Qureshi, M. Ali, and N. Crespi, "A comparative study of web application security parameters: current trends and future directions," Applied Sciences, vol. 12, no. 8, p. 4077, 2022, doi: https://doi.org/10.3390/app12084077.
[8] S. Qadir, E. Waheed, A. Khanum, and S. Jehan, "Comparative evaluation of approaches and tools for effective security testing of web applications," PeerJ Computer Science, vol. 11, p. e2821, 2025, doi: https://doi.org/10.7717/peerj-cs.2821.
[9] M. Alghawazi, D. Alghazzawi, and S. Alarifi, "Detection of SQL injection attack using machine learning techniques: a systematic literature review," Journal of Cybersecurity and Privacy, vol. 2, no. 4, pp. 764-777, 2022, doi: https://doi.org/10.3390/jcp2040039.
[10] J. Kaur, U. Garg, and G. Bathla, "Detection of cross-site scripting (XSS) attacks using machine learning techniques: a review," Artificial Intelligence Review, vol. 56, no. 11, pp. 12725-12769, 2023, doi: https://doi.org/10.1007/s10462-023-10433-3.
[11] A. Paul, V. Sharma, and O. Olukoya, "SQL injection attack: detection, prioritization and prevention," Journal of Information Security and Applications, vol. 85, p. 103871, 2024, doi: https://doi.org/10.1016/j.jisa.2024.103871.
[12] R. Bakır, "UniEmbed: a novel approach to detect XSS and SQL injection attacks leveraging multiple feature fusion with machine learning techniques," Arabian Journal for Science and Engineering, vol. 50, no. 19, pp. 15591-15604, 2025, doi: https://doi.org/10.1007/s13369-024-09916-4.
[13] A. Anas, S. Elgamal, and B. Youssef, "Survey on detecting and preventing web application broken access control attacks," International Journal of Electrical and Computer Engineering, vol. 14, no. 1, pp. 772-781, 2024, doi: https://doi.org/10.11591/ijece.v14i1.pp772-781.
[14] R. A. Khan, S. U. Khan, H. U. Khan, and M. Ilyas, "Systematic mapping study on security approaches in secure software engineering," IEEE Access, vol. 9, pp. 19139-19160, 2021, doi: https://doi.org/10.1109/ACCESS.2021.3052311.
[15] R. N. Rajapakse, M. Zahedi, M. A. Babar, and H. Shen, "Challenges and solutions when adopting DevSecOps: a systematic review," Information and Software Technology, vol. 141, p. 106700, 2022, doi: https://doi.org/10.1016/j.infsof.2021.106700.
[16] K. Rindell, J. Ruohonen, J. Holvitie, S. Hyrynsalmi, and V. Leppänen, "Security in agile software development: a practitioner survey," Information and Software Technology, vol. 131, p. 106488, 2021, doi: https://doi.org/10.1016/j.infsof.2020.106488.
[17] S. M. Khalil, H. Bahsi, and T. Korõtko, "Threat modeling of industrial control systems: a systematic literature review," Computers & Security, vol. 136, p. 103543, 2024, doi: https://doi.org/10.1016/j.cose.2023.103543.
[18] M. Tatam, B. Shanmugam, S. Azam, and K. Kannoorpatti, "A review of threat modelling approaches for APT-style attacks," Heliyon, vol. 7, no. 1, p. e05969, 2021, doi: https://doi.org/10.1016/j.heliyon.2021.e05969.
[19] F. Valenza, E. Karafili, R. V. Steiner, and E. C. Lupu, "A hybrid threat model for smart systems," IEEE Transactions on Dependable and Secure Computing, vol. 20, no. 5, pp. 4403-4417, 2023, doi: https://doi.org/10.1109/TDSC.2022.3213577.
[20] E. Bjarnason, F. Lang, and A. Mjöberg, "An empirically based model of software prototyping: a mapping study and a multi-case study," Empirical Software Engineering, vol. 28, no. 5, p. 115, 2023, doi: https://doi.org/10.1007/s10664-023-10331-w.
[21] T. Yilmaz and Ö. Ulusoy, "Understanding security vulnerabilities in student code: a case study in a non-security course," Journal of Systems and Software, vol. 185, p. 111150, 2022, doi: https://doi.org/10.1016/j.jss.2021.111150.
[22] M. Ismail, N. T. Madathil, M. Alalawi, S. Alrabaee, M. Al Bataineh, S. Melhem, and D. Mouheb, "Cybersecurity activities for education and curriculum design: a survey," Computers in Human Behavior Reports, vol. 16, p. 100501, 2024, doi: https://doi.org/10.1016/j.chbr.2024.100501.
[23] R. S. Sandhu, E. J. Coyne, H. L. Feinstein, and C. E. Youman, "Role-based access control models," Computer, vol. 29, no. 2, pp. 38-47, 1996, doi: https://doi.org/10.1109/2.485845.
[24] T. H. M. Le, H. Chen, and M. A. Babar, "A survey on data-driven software vulnerability assessment and prioritization," ACM Computing Surveys, vol. 55, no. 5, pp. 1-39, 2022, doi: https://doi.org/10.1145/3529757.
[25] A. Sharma, S. Sabharwal, and S. Nagpal, "A hybrid scoring system for prioritization of software vulnerabilities," Computers & Security, vol. 129, p. 103256, 2023, doi: https://doi.org/10.1016/j.cose.2023.103256.
[26] A. Kurniawan, M. Y. Darus, M. A. M. Ariffin, Y. Muliono, and C. R. Pardomuan, "Automation of quantifying security risk level on injection attacks based on common vulnerability scoring system metric," Pertanika Journal of Science and Technology, vol. 31, no. 3, pp. 1245-1265, 2023, doi: https://doi.org/10.47836/pjst.31.3.07.
[27] J. Spring, E. Hatleback, A. Householder, A. Manion, and D. Shick, "Time to change the CVSS?," IEEE Security & Privacy, vol. 19, no. 2, pp. 74-78, 2021, doi: https://doi.org/10.1109/MSEC.2020.3044475.
[28] C. R. Pardomuan, A. Kurniawan, M. Y. Darus, M. A. M. Ariffin, and Y. Muliono, "Server-side cross-site scripting detection powered by HTML semantic parsing inspired by XSS auditor," Pertanika Journal of Science and Technology, vol. 31, no. 3, pp. 1353-1377, 2023, doi: https://doi.org/10.47836/pjst.31.3.14.
Published
How to Cite
Issue
Section
License
Copyright (c) 2026 Donny Sanjaya, Indri Sulistianingsih, Rizka Salsabila Riadi, Ridha Maya Faza Lubis
This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License.
