← Years 9–10 Digital Systems

Writing a threat model table

A table with one row per threat. Columns record the asset, threat, vulnerability, risk rating and chosen control, e.g. a school app storing student data.

Part of: 9-10 Digital Technologies Vic Curric - Digital Systems and Security — Module 78, VCE Software Development - U4O2 - Cyber Security: secure software development practices — Module 79, ACARA Digital Technologies Years 9–10 — Networked Systems and Access Control — Module 145, ACARA Digital Technologies Years 9–10 — Cyber Security Threats and Vulnerabilities — Module 52, WA Computer Science ATAR Year 11 — Network Communications — Module 101

Understanding Writing a threat model table in Years 9–10 Digital Systems

What it does: The row lists a user weakness (a weak password) against the asset it puts at risk and picks MFA as the control. The row records a supply chain weakness (an unsafe third-party library) and picks code signing to check that updates come from a trusted source. The asset is the thing worth protecting, like the student records. A phishing email is a threat, not an asset. Each threat gets its own row so it can have its own vulnerability, risk rating and control. Unvalidated input in the app's code is a software vulnerability. Being tricked by a fake email is a user vulnerability.

Common mistakes: SQL injection is the threat, so it belongs in the Threat column. The vulnerability is the weakness that lets it happen, such as unvalidated input. The teacher login is the asset, not the threat. The Threat column should name what could cause harm, such as a phishing email.

Class: _____________________  ·  Name: _____________________  ·  Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Writing a threat model table to a class →

This module's key terms are also in a printable crossword (Modules 70–79) and word search (Modules 41–79).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning
Duo
Which describes one row of a threat model table?
A list of every threat in the whole system in one cellOne asset, one threat, its vulnerability, risk rating and control
Matches
Student records | Data theft, Account takeover, Malware | Weak password | High | MFA
↓
Three threats are crammed into one row. A threat model table needs one row per threat, so each threat should be split out with its own vulnerability, risk and control.
Applying
Meanings
Term
threat model table
Meaning
A table with one row per threat. Columns record the asset, threat, vulnerability, risk rating and chosen control, e.g. a school app storing student data.
Practice
Asset | Threat | Vulnerability | Risk | Control
Testing
Gaps
asset, threat, vulnerability, risk,
Check Answer
Spots
2Threat: SQL injection
3Vuln: SQL injection

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

The 'Oryx' badge — Desert Navigator, one of Cloodit's 106 collectible badges
Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy
Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games
Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print
Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. Which describes one row of a threat model table?
A. One asset, one threat, its vulnerability, risk rating and control ✓
B. A list of every threat in the whole system in one cell
A threat model table has one row per threat, with the asset, threat, vulnerability, risk and control filled in.
2. A school app stores student data. What goes in the Asset column?
A. Phishing email
B. Student records database ✓
The asset is the thing worth protecting, like the student records. A phishing email is a threat, not an asset.
3. A threat model table has 3 different threats to the school app. How many rows should it have?
A. 1 row covering all threats
B. 3 rows, one per threat ✓
Each threat gets its own row so it can have its own vulnerability, risk rating and control.
4. Which is a software vulnerability for the Vulnerability column of the school app?
A. Login form does not validate input, allowing SQL injection ✓
B. A teacher is tricked by a fake email
Unvalidated input in the app's code is a software vulnerability. Being tricked by a fake email is a user vulnerability.
5. Which row shows a user vulnerability?
A. Threat: phishing | Vulnerability: staff re-use weak passwords ✓
B. Threat: phishing | Vulnerability: unvalidated SQL input
A user vulnerability comes from human behaviour, such as weak or re-used passwords.

Match the Pairs

Asset | Threat | Vulnerability | Risk | Control → The five column headings of a threat model table, which has one row for each threat
Student records | Data theft | SQL injection | High | Input validation → One row of a threat model table for a school app that has a software vulnerability
A user vulnerability gets its own row: the asset is the teacher accounts, and the control is MFA → Teacher accounts | Account takeover | Weak password | High | MFA
A supply chain vulnerability gets its own row: the asset is the app, and the control is checking the trusted source → School app | Malicious update | Unsafe library | Medium | Code signing
Student records | Data theft, Account takeover, Malware | Weak password | High | MFA → Three threats are crammed into one row. A threat model table needs one row per threat, so each threat should be split out with its own vulnerability, risk and control.
Student records | Data theft | SQL injection | High | → The control column is empty. Every row needs a chosen control, such as input validation, to show how the risk will be reduced.

Key Term

threat model table
A table with one row per threat. Columns record the asset, threat, vulnerability, risk rating and chosen control, e.g. a school app storing student data.

Fill in the Blanks

1. asset, threat, vulnerability, risk, control
Hint: Type the column name that records the chosen fix for each threat
2. asset: Student records threat: SQL injection vulnerability: no input validation
Hint: Type the column name for what could harm the asset
3. asset: Teacher accounts threat: Phishing email vulnerability: staff re-use passwords
Hint: Type the column name for the weakness that lets the threat succeed
4. asset: Student records likelihood: likely, impact: severe risk: high
Hint: Type the risk rating that matches a likely event with severe impact
5. threat: Typosquatted package vulnerability: unchecked library control: verify code signing
Hint: Type the supply chain control that proves software comes from a trusted publisher

Spot the Error

Question 1
A Asset: Student data
B Threat: SQL injection
C Vuln: SQL injection
D Risk: High
E Control: Validate input
Line C — SQL injection is the threat, so it belongs in the Threat column. The vulnerability is the weakness that lets it happen, such as unvalidated input.
Question 2
A Asset: Teacher login
B Threat: Teacher login
C Vuln: staff click links
D Risk: High
E Control: Staff training
Line B — The teacher login is the asset, not the threat. The Threat column should name what could cause harm, such as a phishing email.
Question 3
A Asset: School app code
B Threat: Malicious package
C Vuln: unchecked dependencies
D Risk: Update the library
E Control: Use trusted sources
Line D — The Risk column holds a rating such as Low, Medium or High. Updating the library is an action, so it is a control and belongs in the Control column.
Question 4
A Asset: Hacker
B Threat: Data theft
C Vuln: unpatched software
D Risk: High
E Control: Install updates
Line A — A hacker is a threat actor, not an asset. An asset is something worth protecting, such as student data.
Question 5
A Asset: Student data
B Threat: Ransomware and DoS
C Vuln: no offline backups
D Risk: High
E Control: Keep backups
Line B — A threat model table has one row per threat. Ransomware and DoS are different threats, so each needs its own row with its own risk and control.

Student with a class code? Join your class →