STRIDE Analysis — Crown Jewel Attack Paths

Purpose: For each crown jewel in crown-jewels.md, evaluate the six STRIDE threat categories (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege), document the attack method, the current control, and any residual gap.

Owner: Rory (Security Officer) Audience: Security Officer, engineering, auditors Review frequency: Annual in December, plus when a crown jewel's threat surface materially changes Last reviewed: April 2026

---

Reading the tables

• Threat: the specific attack method (mapped to MITRE ATT&CK where practical)
• Current control: the primary preventive or detective control in place
• Gap / residual risk: what remains after the current control, expressed as LOW / MEDIUM / HIGH
• Tracking: SecOps story or backlog item if the residual risk has an owner

---

CJ-1 — psql-secops-prod (PHI data store)

S — Spoofing

Threat	Current control	Gap
Attacker impersonates SecOps app service principal	Entra managed identity, short-lived tokens, no shared secrets	LOW
Attacker impersonates a human DB admin	Entra AD authentication only, no local SQL accounts, Keeper PAM session recording	LOW

T — Tampering

Threat	Current control	Gap
Row-level tampering of evidence or incident records	PITR 35d, backup to Object Lock, pgaudit (in build)	MEDIUM — until pgaudit live
Schema tampering	DDL audited, only infra admin role has DDL rights	LOW

R — Repudiation

Threat	Current control	Gap
An operator denies making a change	pgaudit stream to LAW (scheduled), app-level user-id on every write	MEDIUM — pgaudit pending
Kobe denies an automated write	PR-reviewed PAT flows; every commit signed by Kobe's GitHub identity	LOW

I — Information Disclosure

Threat	Current control	Gap
DB dump exfiltration	Private endpoint only, Palo Alto egress inspection, Defender for SQL anomaly, DNS Security for C2	LOW
Read via stolen app secret	Secrets in Key Vault (not code), rotation schedule, KV access logged	MEDIUM

D — Denial of Service

Threat	Current control	Gap
Resource exhaustion against DB	Azure SLA, connection limits, alerting on sustained CPU/IO	LOW
DROP DATABASE or mass delete	Role restrictions, pgaudit to LAW (pending), PITR for restore	MEDIUM

E — Elevation of Privilege

Threat	Current control	Gap
App role escalates to DB admin	Separate secops_app role, quarterly LPRIV audit (compliance/lpriv-secops-audit.md)	LOW

---

CJ-2 — SharePoint PHI

S

Threat	Current control	Gap
Attacker impersonates a user via AiTM phishing	Conditional Access + device compliance; FIDO2 planned for privileged	MEDIUM — pending FIDO2
OAuth consent phishing (malicious app)	Admin consent required for sensitive scopes; SecOps identity agent flags anomalous consent	MEDIUM

T

Threat	Current control	Gap
File tampering in a shared library	M365 audit log, versioning on libraries, DLP, SharePoint retention	LOW

R

Threat	Current control	Gap
User denies downloading PHI	M365 audit log + Graph API logs in LAW	LOW

I

Threat	Current control	Gap
Bulk download / sync from trusted user account	DLP + abnormal-volume detection + UBA (in build)	MEDIUM
Share link with anonymous access	Anonymous sharing disabled org-wide; exception review via SecOps story	LOW

D

Threat	Current control	Gap
Ransomware encrypts SharePoint files	M365 retention + versioning; Microsoft-side resilience	LOW

E

Threat	Current control	Gap
Site owner grants admin to themselves	M365 audit log; periodic permissions review	MEDIUM

---

CJ-3 — Active Directory forests

S

Threat	Current control	Gap
Pass-the-Hash with stolen DA hash	4624/4648 monitoring; planned kill-chain lateral-movement agent	HIGH — agent in build
Overpass-the-Hash / Pass-the-Ticket	Same as above + Kerberos-specific events	HIGH

T

Threat	Current control	Gap
GPO modification to deploy ransomware	5136/5137 directory-service events; GPO baseline verified via Maester on-prem (scheduled)	MEDIUM
Schema tampering	Schema Admin membership empty; break-glass only	LOW

R

Threat	Current control	Gap
Adversary clears Security log (EventID 1102)	1102 agent fires CRITICAL immediately; log retained in LAW before clearing	LOW (detection guaranteed)

I

Threat	Current control	Gap
DCSync — dumping KRBTGT hash	4662 SACL on directory object (scheduled); Cortex XDR behavioral	HIGH — full coverage pending
NTDS.dit extraction from a DC	File audit + VSS creation monitoring; Cortex XDR	MEDIUM

D

Threat	Current control	Gap
DC crash / replication failure	Multi-DC redundancy, RSV + Veeam backup	LOW

E

Threat	Current control	Gap
Kerberoasting against service accounts	High-entropy service account passwords; 4769 encryption-type monitoring	MEDIUM
Privilege escalation via abused delegation	Delegation audit via Maester on-prem (scheduled)	MEDIUM

---

CJ-4 — Palo Alto Panorama

S

Threat	Current control	Gap
Admin account takeover	Named admin accounts + MFA, break-glass local account for each firewall	LOW

T

Threat	Current control	Gap
Attacker modifies security policy (allow egress, disable DNS Security)	Panorama admin audit, syslog to LAW out-of-band, config backup schedule	MEDIUM
Decryption policy disabled	Same as above; monthly security review §2 checks policy hash	MEDIUM

R

Threat	Current control	Gap
Admin denies making a policy change	Panorama admin audit, change ticket required via SecOps	LOW

I

Threat	Current control	Gap
Exfiltration of Panorama config (passwords, topology)	RBAC tight, config backup creds rotated (palo-alto-backup-credential-rotation.md)	LOW

D

Threat	Current control	Gap
Panorama down — firewalls operate with last-known config	4 independent enforcement nodes, local break-glass	LOW

E

Threat	Current control	Gap
Read-only admin escalates to superuser	Role audit in monthly review	LOW

---

CJ-5 — KRBTGT

S / T

Threat	Current control	Gap
Golden Ticket forged after DCSync	4662 SACL (scheduled), KRBTGT age monitoring, response playbook for 2x rotation	HIGH

R

Threat	Current control	Gap
N/A — KRBTGT is infrastructure, not an actor	—	—

I

Threat	Current control	Gap
DCSync exfil of KRBTGT hash	Same as S/T; Cortex XDR behavioral on DCs	HIGH

D

Threat	Current control	Gap
Loss / corruption of KRBTGT	AD replication redundancy; never rotate without documented procedure	LOW

E

Threat	Current control	Gap
Implicit — any KRBTGT compromise is elevation	Covered above	—

---

CJ-6 — Break-glass accounts

S

Threat	Current control	Gap
Unauthorized sign-in to break-glass	Permanently unsuppressible rule fires CRITICAL; API blocks suppression	LOW

T

Threat	Current control	Gap
Tampering with break-glass credential storage	Keeper record with split knowledge; physical safekeeping	LOW

R

Threat	Current control	Gap
SO denies a break-glass use	Every use documented; audit trail non-repudiable	LOW

I

Threat	Current control	Gap
Exfil of the credential itself	Physical safekeeping, access-logged Keeper record	LOW

D

Threat	Current control	Gap
Account lockout prevents legitimate emergency use	Regular-interval drill (twice yearly) validates account viability	LOW

E

Threat	Current control	Gap
Break-glass is already max privilege	—	—

---

CJ-7 — Azure Key Vaults

S

Threat	Current control	Gap
Service principal impersonation to read secrets	Conditional Access on workload identity; short-lived federated credentials	LOW

T

Threat	Current control	Gap
Tampering with secret versions	KV versioning + soft-delete + purge protection	LOW

R

Threat	Current control	Gap
Operator denies rotating a secret	KV diagnostic logs to LAW	LOW

I

Threat	Current control	Gap
Secret exfiltration via KV read	RBAC tight, only named identities, egress via private endpoint where supported	LOW

D

Threat	Current control	Gap
Vault throttling / DoS	Regional redundancy; KV SLA	LOW

E

Threat	Current control	Gap
Reader role escalates to Secret Reader	Role-separation audit quarterly; KV role review	LOW

---

CJ-8 — Veeam backup servers

S

Threat	Current control	Gap
Attacker impersonates Veeam service account	Dedicated service account, isolated management network	LOW

T

Threat	Current control	Gap
Backup deletion / encryption	S3 Object Lock (2190d) + RSV immutability (Unlocked) are independent of Veeam state	MEDIUM

R

Threat	Current control	Gap
Operator denies modifying retention	Veeam audit log + SecOps change tickets	LOW

I

Threat	Current control	Gap
Backup image exfil (contains snapshots of PHI VMs)	Offsite storage behind Object Lock; access restricted	MEDIUM

D

Threat	Current control	Gap
Veeam server shutdown or encryption	S3 Object Lock independent path; RSV independent path; Q2 DR test validates	MEDIUM — validation pending Q2

E

Threat	Current control	Gap
Veeam admin escalates domain privileges	Veeam service account separate from AD admin tier	LOW

---

Aggregate gap summary

Severity	Crown jewels with open gaps
HIGH	CJ-3 (lateral movement + DCSync detection pending), CJ-5 (KRBTGT DCSync pending)
MEDIUM	CJ-1 (pgaudit pending), CJ-2 (FIDO2 + OAuth governance), CJ-4 (policy tamper), CJ-8 (DR validation)
LOW	CJ-6 (breakglass), CJ-7 (Key Vault)

All HIGH gaps are on the current-week or current-month priority list (kill-chain Phase 1 + Phase 2 work). Every MEDIUM gap has a named owner and a target in compliance/compliance-scorecard.md.

Document history

Date	Change	Author
April 2026	Initial STRIDE analysis across 8 crown jewels	Kobe