Reviewing and updating a threat model

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. A school app adds a new feature that lets students upload photos. What should the team do with the threat model?

A Review it and add new threats, such as unsafe file uploads

B Leave it alone because it was finished last year

2. Which statement about a threat model is true?

A It is a living document that is checked and updated when things change

B It is finished once and never needs to change

3. A developer adds a new third-party library to the project. What is the best next step?

A Assume the library is safe so no update is needed

B Update the threat model to include risks from the new dependency

4. Which is a good reason to review a threat model?

A A new type of attack has started targeting similar systems

B The document has not been printed for a while

5. A team adds multi-factor authentication as a new control. What should they do to the threat model?

A Delete the threats because they can never happen now

B Review it and re-rate the risks that the control reduces

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1Review the threat model		AUpdate model: MFA added, spoofing risk now lower
2New feature: chat added to the app		BA change to the system that adds new data flows, so the threat model must be reviewed and updated
3Adding a new dependency means the threat model must be reviewed for new risks		CA threat model is not a one-off task. It must be reviewed whenever the system, its users or the known threats change.
4After adding a new control, update the threat model to show which threats it reduces		DCheck and update the threat model whenever the system, its users or the known threats change
5Threat model finished in 2022. Never needs checking again.		EUpdate model: added library 'image-resizer' (new third-party risk)
6We added a payment feature, but the threat model stays the same.		FA new feature changes the system, so the threat model must be reviewed and updated to include its new threats.

Definitions

Review the threat model

Fill in the Blanks

Complete each line of code by filling in the missing parts.

__ newFeature = TRUE THEN reviewModel()

_________________(newControl)

FOR EACH threat __ threats DO review(threat)

modelVersion = modelVersion _ 1

IF newUsers __ newThreats THEN reviewModel()

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A new_feature = "file upload"

B if new_feature not in model:

C review_model(old_feature)

Question 2

A new_dep = "log-lib 2.0"

B model.add_dep(new_dep)

C threats = find_cves(model)

D model.threats.extend(threats)

Question 3

A new_ctrl = "MFA"

B likelihood = likelihood + 1

C risk = likelihood * impact

D update_row(threat, risk)

Question 4

A last_review = "2025-01-10"

B if changed and new_threat:

C review_model()

D last_review = today()

Question 5

A for change in threat_log:

B review_model(change)

C update_threats(change)

Answer Key

Reviewing and updating a threat model

Section A: Quick Questions

A — Review it and add new threats, such as unsafe file uploads

A — It is a living document that is checked and updated when things change

B — Update the threat model to include risks from the new dependency

A — A new type of attack has started targeting similar systems

B — Review it and re-rate the risks that the control reduces

Section B: Match the Pairs

Review the threat model → Check and update the threat model whenever the system, its users or the known threats change

New feature: chat added to the app → A change to the system that adds new data flows, so the threat model must be reviewed and updated

Adding a new dependency means the threat model must be reviewed for new risks → Update model: added library 'image-resizer' (new third-party risk)

After adding a new control, update the threat model to show which threats it reduces → Update model: MFA added, spoofing risk now lower

Threat model finished in 2022. Never needs checking again. → A threat model is not a one-off task. It must be reviewed whenever the system, its users or the known threats change.

We added a payment feature, but the threat model stays the same. → A new feature changes the system, so the threat model must be reviewed and updated to include its new threats.

Section C: Definitions

Review the threat model — Check and update a threat model whenever the system, its users or the known threats change, for example after adding a new feature, a new dependency or a new control.

Section D: Fill in the Blanks

IF newFeature = TRUE THEN reviewModel()

updateThreatModel(newControl)

FOR EACH threat IN threats DO review(threat)

modelVersion = modelVersion + 1

IF newUsers OR newThreats THEN reviewModel()

Section E: Spot the Error

C — The review must cover the new feature that was just added. old_feature is not the feature that changed, so it should be review_model(new_feature).

C — A new dependency brings its own known vulnerabilities. The search must use the new dependency, so it should be find_cves(new_dep), not the whole model.

B — A new control such as MFA makes an attack less likely. The likelihood should go down (likelihood - 1), so the updated risk rating is lower.

B — The model must be reviewed when the system changes OR a new threat appears. Using 'and' misses reviews when only one happens. It should be 'or'.

A — The loop should go through each recorded system change in change_log. Looping over threat_log means changes to the system do not trigger a review.