Mapping the Care Assistant Threat Taxonomy to STRIDE, LINDDUN, CAPEC and CWE

TL;DR

• I mapped all 74 entries of the Care Assistant Threat Taxonomy to STRIDE, to LINDDUN, to CAPEC 3.9 and to CWE 5.0, and checked every CAPEC and CWE ID against MITRE’s definition pages.
• STRIDE fits 25 entries (34%) cleanly. 33 get a label only once you know the threat is there, and 16 get no STRIDE category at all.
• LINDDUN fits 20 cleanly, and 14 of those are entries STRIDE misses, mostly about recordings, inference and consent. Together the two prompt for 39 entries (53%).
• Only 8 entries (11%) have a CAPEC attack pattern that describes them, and 61 have none. CWE names the flaw for 12 (16%). 34 entries have neither a CAPEC nor a CWE ID.
• 35 entries (47%) are missed by all four: no clean STRIDE or LINDDUN prompt, and no direct CAPEC or CWE match. 27 of them are life-safety entries, which is 60% of the 45 life-safety entries in the taxonomy.
• That is the case for a domain taxonomy: the general frameworks were built for attackers and for personal data. In care monitoring, most of what goes wrong is neither.

Introduction

In Nobody Asked the Person Being Watched I made a claim: apply STRIDE to a home monitoring design and it will surface something, but it will rarely surface the threats in the taxonomy. A claim like that deserves evidence, so here it is.

I have run this exercise before, for the email and Software Factory taxonomies, with STRIDE, CAPEC and CWE. This domain needs a fourth column. Much of care monitoring is about personal data and consent, so LINDDUN, the privacy threat modeling framework, belongs alongside STRIDE as a first-class prompt rather than an afterthought. I took every one of the 74 entries in the taxonomy, the 65 suit entries and the 9 structural hazards, and asked four questions:

1. Which STRIDE categories does it belong to, and does STRIDE fit cleanly? A clean fit means a facilitator holding a STRIDE prompt would plausibly ask the question that finds this threat. A loose fit means a category can be assigned, but only after you already know the threat is there. None means no STRIDE category applies.
2. Which LINDDUN categories does it belong to, and does LINDDUN fit cleanly? The same test, with the LINDDUN prompts: linking, identifying, non-repudiation, detecting, data disclosure, unawareness and non-compliance.
3. Is there a CAPEC attack pattern for it? Direct means a CAPEC entry describes this attack or a near-exact analogue. Partial means only a generic parent pattern applies. None means CAPEC has nothing that would lead you to it.
4. Is there a CWE weakness for it? Direct means a CWE weakness names the flaw the entry describes. Partial means only a broader or adjacent weakness applies. None means no CWE weakness names it.

Every CAPEC ID below was checked against MITRE’s CAPEC 3.9 definition pages, and every CWE ID against CWE 5.0, released on 28 October 2026, so each ID exists and the name is MITRE’s own. Weaknesses MITRE discourages for mapping were replaced, and the Class-level entries kept here are ones MITRE allows with review. For CAPEC and CWE, the rating applies to the entry’s list as a whole. The fit ratings are my judgement, and I’d welcome challenges to any of them; the data files give the reason for every rating.

Note to threat modelers: the point of this post is not that STRIDE, LINDDUN, CAPEC and CWE are bad. I have spent years building on them. The point is that they are general-purpose, and a domain where the person at risk is not the user needs a domain map as well.

What the mapping shows

Across all 74 entries, STRIDE fits 25 cleanly, 33 loosely and 16 not at all. LINDDUN fits 20 cleanly, 13 loosely and 41 not at all. CAPEC describes 8 directly, 5 only by a generic parent, and has nothing for 61. CWE names 12 directly, 25 only broadly, and has nothing for 37. 35 entries are missed by all four.

STRIDE fit, LINDDUN fit, CAPEC 3.9 match and CWE 5.0 match for each suit, with the number of entries per suit that all four frameworks miss. Sight and Sound is the only suit they cover completely; every structural hazard escapes all four.

The split by suit tells the story:

• Cameras are the one place the frameworks work. Sight and Sound is the only suit with no entry missed by all four. A stranger’s voice through talk-back is credential stuffing (CAPEC-600), an open stream is a probe of audio and video peripherals (CAPEC-634) behind missing authentication (CWE-306), and an unencrypted radio monitor is interception (CAPEC-117) of cleartext (CWE-319). These are the threats the industry already talks about, and they are the ones with headline incidents.
• The alert chain is where they go blind. Interpretation has 5 of 7 entries missed by all four, and Alerting 4 of 7. An adaptive baseline that learns decline as normal, a “false alarm” button that ratchets thresholds, an alert delivered to a silenced phone, nobody on call: none of these is an attack, and none is a privacy harm. They are failures of the product’s one job.
• Denial of service is the wrong question. D is the most common STRIDE letter in the taxonomy, on 22 entries, but it fits cleanly on only 4. STRIDE asks whether someone can make a component unavailable. The care question is whether the system notices when it has gone quiet, and whether silence reads as good news (EOC-T1, Silence Reads as Safety).
• Life-safety and coverage run in opposite directions. 27 of the 45 life-safety entries are missed by all four frameworks, against 8 of the other 29. The threats that can leave someone on the floor until morning are exactly the ones general-purpose sessions are least likely to find.
• Structural hazards. All 9 escape all four. Silence Reads as Safety, The Watched Is Not the User, Promised Vigilance and Capacity Is Not Fixed are not faults in a component; they are properties of the domain, and they explain findings in every suit.

Note to facilitators: if you run STRIDE on a care monitoring design, add Interpretation and Alerting as an explicit second pass, and play the structural hazards against the whole design at the end. That is where a STRIDE session leaves you blind, and it is where people get hurt.

Where LINDDUN fits

LINDDUN earns its column. It fits 20 entries cleanly, and 14 of those are entries STRIDE fits only loosely or not at all: Clips That Travel (EOC-AV-Q), The Camera Sees Too Much (EOC-AV-J), Hidden Nanny Cam (EOC-AV-10), Wrong Recipient (EOC-AL-10), Watched by the Service (EOC-CC-8), Enrolled Without Knowing (EOC-RE-9), Bystander Data (EOC-RE-8), Monitoring That Outlives Its Purpose (EOC-RE-7), Inferred Diagnosis (EOC-DA-J), Second Purpose (EOC-DA-10), Frailty Map (EOC-DA-9), Erasure That Doesn’t (EOC-DA-8), Copies That Linger (EOC-DA-7), Second-Hand Device (EOC-LC-10). They are concentrated in Sight and Sound, Resident and Data and Inference, where the question is not who broke in but who was told, what was kept and what can be inferred. STRIDE has no category for a hidden nanny cam or for monitoring that outlives its purpose; LINDDUN’s unawareness and non-compliance prompts ask about both directly.

It still misses most of the taxonomy. 41 entries get no LINDDUN category at all, and 13 only a loose one. Three kinds of threat sit outside it:

• Harm by an authorised watcher. Watching as Control (EOC-CC-K) and Ex-Partner Still Watching (EOC-CC-A) involve people with valid access using it against the person. LINDDUN assumes the data controller is the party to hold to account, not one of the family.
• Consent that changes. LINDDUN treats consent as a compliance question. Consent Out of Step with Capacity (EOC-RE-10) and Capacity Is Not Fixed (EOC-T9) are about consent that was valid once and has quietly stopped being so, as a child grows or as capacity fades or fluctuates.
• Harm from the watching itself. Watched into Distress (EOC-RE-Q) and Rights on Paper (EOC-RE-J) are about the effect of the system on the person, not about their data.

Note to privacy engineers: a DPIA built on LINDDUN will catch the recordings, the inferences and the retention. Add the Resident suit to it, so the person’s capacity and their experience of being watched are on the page too.

Where CAPEC and CWE fit

CAPEC is a catalogue of attacks, and this domain has few of them. 13 entries carry a CAPEC ID at all, and only 8 are a direct match: jamming, physical hacking of the hub, credential stuffing, probing a camera, interception, phishing, pretexting at the door and session hijacking. Every one of them is an attacker going after a device or an account. Nothing in CAPEC describes a sensor whose silence looks like a quiet home, a monitoring centre that is down, or an alert that went to the wrong person because a phone number was recycled.

CWE does better, as it did for the other taxonomies, but less well than you might expect. 37 entries carry a CWE ID and 12 are a direct match, from Missing Authentication for Critical Function to Improper Scrubbing of Sensitive Data from Decommissioned Device. The most cited weakness, Exposure of Private Personal Information to an Unauthorized Actor (CWE-359), appears against 7 entries, and is the right label for the lock-screen alert, the routine read as a burglar’s timetable and the leaked list of vulnerable people. It is a question for none of them.

34 entries have neither a CAPEC nor a CWE ID. That is not an oversight: they are not attacks and not software weaknesses. They are the response chain, the people around the person, and the lifecycle of the household. Where a CAPEC pattern or CWE weakness would fit if added, I have listed it separately as a proposal for the next version rather than changing the taxonomy in this post.

Note to AppSec teams: tag the findings you do get with CWE, so they line up with your scanners and your issue tracker. Just don’t expect CWE to tell you where to look.

What all four miss

The 35 entries missed by all four fall into five groups:

• The alert chain: Silent Sensor (EOC-SN-A), Pendant on the Bedside Table (EOC-SN-Q), Unwatched Room (EOC-SN-J), Model Veto (EOC-IN-A), Learning an Empty House (EOC-IN-Q), Learned Decline (EOC-IN-J), Feedback Ratchet (EOC-IN-10), Second Occupant (EOC-IN-8), Delivered to a Phone, Not a Person (EOC-AL-A), Nobody on Call (EOC-AL-K), Silent Snooze (EOC-AL-Q), Unmeasured Delay (EOC-AL-J).
• The response: Lost in Hand-off (EOC-RS-10), Wrong Responder (EOC-RS-9).
• The people: Ex-Partner Still Watching (EOC-CC-A), Watching as Control (EOC-CC-K), Family Feud (EOC-CC-10), Unplugged on Purpose (EOC-RE-K), Watched into Distress (EOC-RE-Q), Rights on Paper (EOC-RE-J), Consent Out of Step with Capacity (EOC-RE-10), Evidence Against Them (EOC-DA-K).
• The household’s lifecycle: Fleet-Wide Regression (EOC-LC-A), Vendor Exit (EOC-LC-K), After a Death (EOC-LC-J), Moved Out (EOC-LC-9).
• The structural hazards: all 9.

26 of them have no CAPEC pattern and no CWE weakness at all, and at best a loose STRIDE or LINDDUN fit. They have the same shape. Each is about time (drift, delay, capacity that changes, a household that moves on), about people who are not the user, or about the gap between a system that worked and help that arrived. None of the four frameworks was built to ask about any of those, and that is why the taxonomy exists.

The full mapping

STRIDE and LINDDUN letters are listed with the best fit first, and CAPEC patterns and CWE weaknesses in best-fit order. Each table gives every entry’s STRIDE and LINDDUN categories and fit, and its CAPEC patterns and CWE weaknesses by ID and name. An entry that is a loose or no fit in both STRIDE and LINDDUN, with no direct CAPEC or CWE match, is one a general-purpose session is unlikely to find. The same tables are on each suit’s page in the taxonomy, and the Excel, SKOS and STIX downloads carry the mapping as text you can search and filter. The reason for every rating is in the CSV and JSON files that come with this post.

01. Sensing

02. Sight and Sound

03. Interpretation

04. Alerting

05. Response

06. Care Circle

07. Resident

08. Data and Inference

09. Lifecycle

Structural hazards

Final thoughts

The general frameworks are good at what they were built for. STRIDE finds the attacker at the camera, LINDDUN finds the recording nobody needed, CAPEC and CWE give you the words to file both. What they were not built for is a system whose user is not its subject, whose most serious failures are silent, and whose risk sits with someone who may not be able to say no.

If you threat model these systems, use all four, and use the taxonomy to decide where to look. And if you think one of my ratings is wrong, tell me: the data files have the reason for every one, and I’d rather fix a rating than defend it. Next, the game the taxonomy came from. Stay tuned!

References

• Nobody Asked the Person Being Watched: A Threat Taxonomy for Care Monitoring at Home, the taxonomy this post maps
• Care Assistant Threat Taxonomy, overview page with the downloads
• STRIDE, Microsoft
• LINDDUN privacy threat modeling, KU Leuven
• MITRE CAPEC, version 3.9
• MITRE CWE, version 5.0 (28 October 2026), and Guidance on mapping to CWE
• My earlier mappings of the email and Software Factory taxonomies

Tags: Threat Modeling, Privacy, STRIDE, LINDDUN, CAPEC, CWE