While threat modeling a cloud trading application with STRIDE, the team finds that a user could submit an order and later credibly deny having done so, because the system keeps no reliable record that ties the action to the user. Which STRIDE category is this?

STRIDE classifies threats into six categories, each the violation of a security property: spoofing violates authentication, tampering violates integrity, repudiation violates non-repudiation, information disclosure violates confidentiality, denial of service violates availability, and elevation of privilege violates authorization. Repudiation describes a user or system denying an action because there is insufficient evidence to prove it took place or who performed it. The mitigations are strong authentication tied to each action, secure and tamper-evident audit logs, synchronized timestamps, and where required digital signatures over transactions, which provide proof of origin. Spoofing is pretending to be someone else, for example by using stolen credentials; the scenario involves a genuine user denying their own action, not an impersonator. Tampering is unauthorized modification of data or code, such as altering an order in transit or in a database; nothing is modified here, and the weakness is the absence of attribution. Information disclosure is exposure of data to parties not authorized to see it, which the scenario does not describe. Exam caveat: hashing alone shows that data has not changed but does not prove who created it; non-repudiation needs a signature or equivalent attributable evidence. Operational check: verify that order submissions write audit records with authenticated user identity, time and transaction details to a log store the user cannot alter.