Threat Modeling

  1. Threat Analysis and Risk Assessment
    1. Risk Assessment and Prioritization
      1. Qualitative vs. Quantitative Analysis
        1. Pros and Cons
          1. Example Scoring Systems
          2. The DREAD Model
            1. Damage Potential
              1. Reproducibility
                1. Exploitability
                  1. Affected Users
                    1. Discoverability
                      1. Calculating DREAD Scores
                      2. CVSS
                        1. Base Metrics
                          1. Temporal Metrics
                            1. Environmental Metrics
                              1. Scoring Vulnerabilities
                              2. Custom Risk Rating Systems
                                1. Organization-Specific Criteria
                                  1. Calibration and Consistency
                                2. Developing Mitigations and Countermeasures
                                  1. The Four Mitigation Strategies
                                    1. Reduce
                                      1. Technical Controls
                                        1. Process Controls
                                        2. Eliminate
                                          1. Architectural Changes
                                            1. Feature Removal
                                            2. Transfer
                                              1. Third-Party Risk Management
                                                1. Contractual Protections
                                                2. Accept
                                                  1. Risk Acceptance Criteria
                                                    1. Documentation of Accepted Risks
                                                3. Types of Security Controls
                                                  1. Preventive Controls
                                                    1. Access Controls
                                                      1. Input Validation
                                                      2. Detective Controls
                                                        1. Logging and Monitoring
                                                          1. Intrusion Detection
                                                          2. Corrective Controls
                                                            1. Incident Response
                                                              1. Patch Management
                                                              2. Deterrent Controls
                                                                1. Security Awareness Training
                                                                  1. Warning Banners
                                                                2. Mapping Controls to Threats
                                                                  1. Security Requirements
                                                                    1. Functional Security Requirements
                                                                      1. Non-Functional Security Requirements
                                                                      2. Secure Coding Practices
                                                                        1. Input Sanitization
                                                                          1. Output Encoding
                                                                          2. Architectural Changes
                                                                            1. Network Segmentation
                                                                              1. Principle of Least Privilege

                                                                          Previous

                                                                          4. Threat Identification and Enumeration

                                                                          Go to top

                                                                          Next

                                                                          6. Validation and Verification