← ACARA Digital Technologies Years 9–10

Reviewing and updating a threat model

Check and update a threat model whenever the system, its users or the known threats change, for example after adding a new feature, a new dependency or a new control.

Part of: ACARA Digital Technologies Years 9–10 — Cyber Security Threats and Vulnerabilities — Module 54

Understanding Reviewing and updating a threat model in ACARA Digital Technologies Years 9–10

What it does: A new dependency is code from outside the team, so the model must record it as a new possible source of threats. A new control changes the likelihood or impact of a threat, so the model is revised to show the updated risk. Systems, users and threats keep changing, so a threat model needs regular reviews to stay useful. A new dependency becomes part of the attack surface. A supply chain attack through it is a new threat to record and rate. Changes in the known threats are a trigger for review. Printing the document does not change the risk.

Common mistakes: The review must cover the new feature that was just added. old_feature is not the feature that changed, so it should be review_model(new_feature). A new dependency brings its own known vulnerabilities. The search must use the new dependency, so it should be find_cves(new_dep), not the whole model.

Class: _____________________ · Name: _____________________ · Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Reviewing and updating a threat model to a class →

This module's key terms are also in a printable crossword (Modules 782–809) and word search (Modules 743–809).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning

Duo

A school app adds a new feature that lets students upload photos. What should the team do with the threat model?

Leave it alone because it was finished last yearReview it and add new threats, such as unsafe file uploads

Matches

Threat model finished in 2022. Never needs checking again.

↓

A threat model is not a one-off task. It must be reviewed whenever the system, its users or the known threats change.

Applying

Meanings

Term

Review the threat model

Meaning

Check and update a threat model whenever the system, its users or the known threats change, for example after adding a new feature, a new dependency or a new control.

Practice

IF new_feature OR new_dependency OR new_control THEN

Testing

Gaps

newFeature = TRUE THEN reviewModel()

Check Answer

Spots

2if new_feature not in model:

3 review_model(old_feature)

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy

Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games

Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print

Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. A school app adds a new feature that lets students upload photos. What should the team do with the threat model?

A. Review it and add new threats, such as unsafe file uploads ✓

B. Leave it alone because it was finished last year

A new feature changes the system. It adds new data flows and new ways to attack, so the threat model must be reviewed and updated.

2. Which statement about a threat model is true?

A. It is a living document that is checked and updated when things change ✓

B. It is finished once and never needs to change

Systems, users and threats keep changing, so a threat model needs regular reviews to stay useful.

3. A developer adds a new third-party library to the project. What is the best next step?

A. Assume the library is safe so no update is needed

B. Update the threat model to include risks from the new dependency ✓

A new dependency becomes part of the attack surface. A supply chain attack through it is a new threat to record and rate.

4. Which is a good reason to review a threat model?

A. A new type of attack has started targeting similar systems ✓

B. The document has not been printed for a while

Changes in the known threats are a trigger for review. Printing the document does not change the risk.

5. A team adds multi-factor authentication as a new control. What should they do to the threat model?

A. Delete the threats because they can never happen now

B. Review it and re-rate the risks that the control reduces ✓

A new control changes the likelihood or impact of some threats. The model should show the new risk ratings. Some risks may remain, for example MFA fatigue attacks.

Match the Pairs

Review the threat model → Check and update the threat model whenever the system, its users or the known threats change

New feature: chat added to the app → A change to the system that adds new data flows, so the threat model must be reviewed and updated

Adding a new dependency means the threat model must be reviewed for new risks → Update model: added library 'image-resizer' (new third-party risk)

After adding a new control, update the threat model to show which threats it reduces → Update model: MFA added, spoofing risk now lower

Threat model finished in 2022. Never needs checking again. → A threat model is not a one-off task. It must be reviewed whenever the system, its users or the known threats change.

We added a payment feature, but the threat model stays the same. → A new feature changes the system, so the threat model must be reviewed and updated to include its new threats.

Key Term

Review the threat model

Check and update a threat model whenever the system, its users or the known threats change, for example after adding a new feature, a new dependency or a new control.

Fill in the Blanks

1. IF newFeature = TRUE THEN reviewModel()

Hint: Type the keyword that starts a selection, so the review only runs when a new feature has been added.

2. updateThreatModel(newControl)

Hint: Type the name of the function that updates the threat model after a new control is added.

3. FOR EACH threat IN threats DO review(threat)

Hint: Type the keyword that links each single threat to the list of known threats being looped through.

4. modelVersion = modelVersion + 1

Hint: Type the arithmetic operator that raises the version number each time the model is updated.

5. IF newUsers OR newThreats THEN reviewModel()

Hint: Type the logical operator that triggers a review when either one of the two changes happens.

Spot the Error

Question 1

A new_feature = "file upload"

B if new_feature not in model:

C review_model(old_feature)

Line C — The review must cover the new feature that was just added. old_feature is not the feature that changed, so it should be review_model(new_feature).

Question 2

A new_dep = "log-lib 2.0"

B model.add_dep(new_dep)

C threats = find_cves(model)

D model.threats.extend(threats)

Line C — A new dependency brings its own known vulnerabilities. The search must use the new dependency, so it should be find_cves(new_dep), not the whole model.

Question 3

A new_ctrl = "MFA"

B likelihood = likelihood + 1

C risk = likelihood * impact

D update_row(threat, risk)

Line B — A new control such as MFA makes an attack less likely. The likelihood should go down (likelihood - 1), so the updated risk rating is lower.

Question 4

A last_review = "2025-01-10"

B if changed and new_threat:

C review_model()

D last_review = today()

Line B — The model must be reviewed when the system changes OR a new threat appears. Using 'and' misses reviews when only one happens. It should be 'or'.

Question 5

A for change in threat_log:

B review_model(change)

C update_threats(change)

Line A — The loop should go through each recorded system change in change_log. Looping over threat_log means changes to the system do not trigger a review.

Student with a class code? Join your class →