A STRIDE-Based Threat Taxonomy for Digital Showcase Platforms in Vocational Higher Education
DOI:
https://doi.org/10.62123/enigma.v4i1.235Keywords:
CVSS, OWASP Top 10, STRIDE, Threat modeling, Vocational educationAbstract
Digital showcase platforms have become central to how vocational higher education institutions publish student portfolios and project artifacts. These platforms combine high public visibility with the storage of personal data, authentication credentials, and project metadata, which widens their attack surface. Existing security studies concentrate on large academic universities and mostly report tool based test results, so a conceptual threat model tailored to the showcase archetype in vocational education is not yet available. This study formulates a STRIDE based threat taxonomy for digital showcase platforms in vocational higher education. A reference data flow diagram of the platform archetype is decomposed into processes, data stores, external entities, and trust boundaries, and the STRIDE method is applied to each element to elicit threat classes. Each threat class is mapped to the OWASP Top 10:2025 categories and assigned a representative severity using the CVSS v3.1 base metric. The resulting taxonomy organizes twenty-one threat classes across the six STRIDE dimensions and links them to concrete platform assets. The taxonomy supports secure by design decisions for platform maintainers and provides a structured basis for subsequent controlled testing and expert validation.
Downloads
References
[1] J. B. Ulven and G. Wangen, "A systematic review of cybersecurity risks in higher education," Future Internet, vol. 13, no. 2, p. 39, 2021, doi: 10.3390/fi13020039.
[2] N. S. Fouad, "Securing higher education against cyberthreats: from an institutional risk to a national policy challenge," Journal of Cyber Policy, vol. 6, no. 2, pp. 137-154, 2021, doi: 10.1080/23738871.2021.1973526.
[3] A. Piazza, S. Vasudevan, and M. Carr, "Cybersecurity in UK universities: mapping (or managing) threat intelligence sharing within the higher education sector," Journal of Cybersecurity, vol. 9, no. 1, p. tyad019, 2023, doi: 10.1093/cybsec/tyad019.
[4] M. Ismail, N. T. Madathil, M. Alalawi, S. Alrabaee, M. Al Bataineh, S. Melhem, and D. Mouheb, "Cybersecurity activities for education and curriculum design: a survey," Computers in Human Behavior Reports, vol. 16, p. 100501, 2024, doi: 10.1016/j.chbr.2024.100501.
[5] K. Abdulghaffar, N. Elmrabit, and M. Yousefi, "Enhancing web application security through automated penetration testing with multiple vulnerability scanners," Computers, vol. 12, no. 11, p. 235, 2023, doi: 10.3390/computers12110235.
[6] M. Albahar, D. Alansari, and A. Jurcut, "An empirical comparison of pen-testing tools for detecting web app vulnerabilities," Electronics, vol. 11, no. 19, p. 2991, 2022, doi: 10.3390/electronics11192991.
[7] J. Shahid, M. K. Hameed, I. T. Javed, K. N. Qureshi, M. Ali, and N. Crespi, "A comparative study of web application security parameters: current trends and future directions," Applied Sciences, vol. 12, no. 8, p. 4077, 2022, doi: 10.3390/app12084077.
[8] S. Qadir, E. Waheed, A. Khanum, and S. Jehan, "Comparative evaluation of approaches and tools for effective security testing of web applications," PeerJ Computer Science, vol. 11, p. e2821, 2025, doi: 10.7717/peerj-cs.2821.
[9] K. U. Sarker, F. Yunus, and A. Deraman, "Penetration taxonomy: a systematic review on the penetration process, framework, standards, tools, and scoring methods," Sustainability, vol. 15, no. 13, p. 10471, 2023, doi: 10.3390/su151310471.
[10] S. M. Khalil, H. Bahsi, and T. Korõtko, "Threat modeling of industrial control systems: a systematic literature review," Computers & Security, vol. 136, p. 103543, 2024, doi: 10.1016/j.cose.2023.103543.
[11] M. Tatam, B. Shanmugam, S. Azam, and K. Kannoorpatti, "A review of threat modelling approaches for APT-style attacks," Heliyon, vol. 7, no. 1, p. e05969, 2021, doi: 10.1016/j.heliyon.2021.e05969.
[12] F. Valenza, E. Karafili, R. V. Steiner, and E. C. Lupu, "A hybrid threat model for smart systems," IEEE Transactions on Dependable and Secure Computing, vol. 20, no. 5, pp. 4403-4417, 2023, doi: 10.1109/TDSC.2022.3213577.
[13] T. H. M. Le, H. Chen, and M. A. Babar, "A survey on data-driven software vulnerability assessment and prioritization," ACM Computing Surveys, vol. 55, no. 5, pp. 1-39, 2022, doi: 10.1145/3529757.
[14] P. Kühn, D. N. Relke, and C. Reuter, "Common vulnerability scoring system prediction based on open source intelligence information sources," Computers & Security, vol. 131, p. 103286, 2023, doi: 10.1016/j.cose.2023.103286.
[15] A. Negahdari Kia, F. Murphy, B. Sheehan, and D. Shannon, "A cyber risk prediction model using common vulnerabilities and exposures," Expert Systems with Applications, vol. 237, p. 121599, 2024, doi: 10.1016/j.eswa.2023.121599.
[16] X. Li, S. Moreschini, Z. Zhang, F. Palomba, and D. Taibi, "The anatomy of a vulnerability database: a systematic mapping study," Journal of Systems and Software, vol. 201, p. 111679, 2023, doi: 10.1016/j.jss.2023.111679.
[17] A. Kurniawan, M. Y. Darus, M. A. Mohd Ariffin, Y. Muliono, and C. R. Pardomuan, "Automation of quantifying security risk level on injection attacks based on common vulnerability scoring system metric," Pertanika Journal of Science and Technology, vol. 31, no. 3, pp. 1245-1265, 2023, doi: 10.47836/pjst.31.3.07.
[18] C. R. Pardomuan, A. Kurniawan, M. Y. Darus, M. A. Mohd Ariffin, and Y. Muliono, "Server-side cross-site scripting detection powered by HTML semantic parsing inspired by XSS Auditor," Pertanika Journal of Science and Technology, vol. 31, no. 3, pp. 1353-1377, 2023, doi: 10.47836/pjst.31.3.14.
[19] A. Sharma, S. Sabharwal, and S. Nagpal, "A hybrid scoring system for prioritization of software vulnerabilities," Computers & Security, vol. 129, p. 103256, 2023, doi: 10.1016/j.cose.2023.103256.
[20] J. Spring, E. Hatleback, A. Householder, A. Manion, and D. Shick, "Time to change the CVSS?," IEEE Security & Privacy, vol. 19, no. 2, pp. 74-78, 2021, doi: 10.1109/MSEC.2020.3044475.
[21] Republic of Indonesia, Law No. 27 of 2022 on Personal Data Protection, Jakarta, Indonesia, 2022.
[22] Republic of China (Taiwan), Personal Data Protection Act, as amended Nov. 2025, Taipei, Taiwan, 2025.
[23] Malaysia, Personal Data Protection Act 2010 (Act 709), as amended by the Personal Data Protection (Amendment) Act 2024 (Act A1727), Kuala Lumpur, Malaysia, 2024.
Downloads
Published
How to Cite
Issue
Section
License
Copyright (c) 2026 Donny Sanjaya, Indri Sulistianingsih, Rizka Salsabila Riadi
This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License.
