Threat Modelling

Question 1

What is threat modelling?

Answer 1

A technique to analyse a system’s security and privacy concerns.

Question 2

What are the five key phases of threat modelling?

Answer 2

Asset identification - determine what you’re protecting.
Threat analysis - identify potential attacks or events that could compromise these assets.
Vulnerability analysis - pinpoint weakness both technical and organisational.
Risk assessment - evaluate the likelihood and impact of each event.
Risk communication - share findings with key stakeholders.

Question 3

What is the STRIDE threat model?

Answer 3

Spoofing
Tampering
Repudiation
Information disclosure
Denial of service
Elevation of privilege

Question 4

What is the DREAD threat model?

Answer 4

Damage potential
Reproducibility
Exploitability
Affected users
Discoverability