A STRIDE-Based Threat Taxonomy for Digital Showcase Platforms in Vocational Higher Education

Digital showcase platforms have become central to how vocational higher education institutions publish student portfolios and project artifacts. These platforms combine high public visibility with the storage of personal data, authentication credentials, and project metadata, which widens their attack surface. Existing security studies concentrate on large academic universities and mostly report tool based test results, so a conceptual threat model tailored to the showcase archetype in vocational education is not yet available. This study formulates a STRIDE based threat taxonomy for digital showcase platforms in vocational higher education. A reference data flow diagram of the platform archetype is decomposed into processes, data stores, external entities, and trust boundaries, and the STRIDE method is applied to each element to elicit threat classes. Each threat class is mapped to the OWASP Top 10:2025 categories and assigned a representative severity using the CVSS v3.1 base metric. The resulting taxonomy organizes twenty-one threat classes across the six STRIDE dimensions and links them to concrete platform assets. The taxonomy supports secure by design decisions for platform maintainers and provides a structured basis for subsequent controlled testing and expert validation.