@newbie Using https and some non-standard domain name system can help mitigate some tracking. Using https means the ISP can only see the domains (and subdomains) of websites you access, and having an encrypted connections can help mitigate man-in-the-middle attacks. I’m not very familiar with DNS, but there’s a section in the Hitchhiker’s Guide to Online Anonymity about DNS (hint: it’s very difficult to fully ensure your DNS requests are anonymized).
I’m not sure what “information disclosure by [an] ISP” would entail. ISPs most certainly try to record what you do on the internet, whether you’re using using a home router, public wifi, or cellular data. If you’re worried about this “dragnet” tracking, and are worried about ISPs “disclosing” the information they have collected on you, then there are reasonable ways to avoid it (i.e. https, somewhat private/secure DNS, VPNs, Tor, open router firmware). But certainly “by using https and secure DNS server[s] only” is not enough.
I’m not really familiar with threat modeling techniques, such as “stride,” but I’d assume that an ISP can: 1) spoof— fake or help fake some external connection for some man-in-the-middle attack, or direct you to new websites entirely; 2) tamper— censor or regulate your internet connection; 3) disclose information— sell data collected about you, but not necessarily target you; and 4) deny you internet or other services (i.e. limit what ports are open).
I don’t think an ISP could easily mess with some non-repudiable digital signature (i.e. from the QubesOS Team) and I don’t think an ISP could (easily) get “sudo” privileges to your devices (some ISPs can remotely control routers, but they’d still have to attack your devices from the router).
Hope this helps