Years 9–10 Digital Systems Definitions Worksheet: Software supply chain vulnerabilities and Threat modelling and security responses (Modules 70–79)
Name:
Date:
Class:
✎
Key terms
Write what each term means, in your own words.
1
reduce supply chain risk
2
risk = likelihood x impact
3
risk matrix
4
data flow diagram
5
trust boundary
6
STRIDE
7
attack tree
8
security control
9
threat model table
10
threat model review
Answer Key
Years 9–10 Digital Systems · Modules 70–79 · Student wording will vary for definitions
1reduce supply chain risk — Use fewer, trusted dependencies, pin versions, verify integrity and scan for known vulnerabilities so a weak link in code you rely on cannot harm your system.
2risk = likelihood x impact — Risk is how likely a threat is to succeed combined with how much harm it would cause. Rate each as low, medium or high to decide which risks matter most.
3risk matrix — A grid that plots how likely a threat is against how bad its impact would be, giving each risk a priority rating (such as low, medium or high) so you know which to fix first.
4data flow diagram — A diagram that shows how data moves between users, processes, data stores and external services in a system, using labelled arrows for each flow.
5trust boundary — A line on a diagram where data passes between parts of a system with different levels of trust, such as from a user's device to a server. Threats often cluster here.
6STRIDE — A memory aid for six threat types: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service and Elevation of privilege. Use it to ask what could go wrong in a system.
7attack tree — A diagram with the attacker's goal at the top, branching into the different ways to reach it. OR branches are alternatives, AND branches are all needed.
8security control — A measure that reduces risk by preventing an attack, detecting it or helping recovery. Controls can be technical, physical or procedural, and layering several works best.
9threat model table — A table with one row per threat. Columns record the asset, threat, vulnerability, risk rating and chosen control, e.g. a school app storing student data.
10threat model review — Checking and updating a threat model whenever the system, its users or the known threats change, for example after a new feature, a new dependency or a new control.