What threat modelling is

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. Which describes threat modelling best?

A A structured way to work out what could go wrong with a system so risks can be dealt with early

B Writing code that attacks a competitor's system to see if it breaks

2. When is the best time to start threat modelling?

A Early, during planning and design, then repeated during development

B Only after the software has been released to users

3. Which is the correct order of the three stages of threat modelling?

A Define the system, identify and mitigate threats, confirm the threats are mitigated

B Confirm the threats are mitigated, define the system, identify and mitigate threats

4. What happens in the 'define' stage?

A Install patches and delete old user accounts

B Work out what the system is, what it does and what needs protecting

5. What happens in the 'confirm' stage?

A Assume the threats are fixed because a control was planned

B Check that each threat has actually been mitigated, for example by testing

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1threat modelling		AThe three stages of threat modelling: describe the system, find threats and plan controls, then check the threats are actually dealt with
2Define → Identify and mitigate → Confirm		BThe final stage is confirm, not release. Without confirming, nobody knows whether the mitigations actually deal with the threats.
3Threat modelling is done early and repeated, so it is reviewed whenever the design or the threats change		CParticipants: developers, testers, security, client
4Threat modelling involves more than one role, such as developers, testers, security staff and the client		DReview threat model: every sprint or design change
5Run threat modelling once after the software is released, then never again		EA structured way to work out what could go wrong with a system, before and during development, so risks can be dealt with early
6Threat model stages: Define → Identify and mitigate → Release (no confirm step)		FThreat modelling should be done early, before and during development, and repeated as the system changes. Doing it once after release finds problems too late and the model goes out of date.

Definitions

threat modelling

Fill in the Blanks

Complete each line of code by filling in the missing parts.

STAGE 1 = ______ the system and its assets

STAGE 2 = ________ threats and mitigate them

STAGE 3 = _______ threats are mitigated

WHEN: _____ in design, then repeat often

WHO: developers, testers and ________ staff

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A stage1 = 'release the system'

B stage2 = 'identify, mitigate'

C stage3 = 'confirm fixes work'

Question 2

A define(system)

B confirm(system)

C mitigate(system)

D confirm(system)

Question 3

A define(system)

B threats = identify(system)

C ignore(threats)

D confirm(threats)

Question 4

A if system_in_development:

B review_threat_model()

C update_controls()

Question 5

A phase = 'design'

B if phase == 'design':

C threat_model('early')

D cost_to_fix = 'high'

Answer Key

What threat modelling is

Section A: Quick Questions

A — A structured way to work out what could go wrong with a system so risks can be dealt with early

A — Early, during planning and design, then repeated during development

A — Define the system, identify and mitigate threats, confirm the threats are mitigated

B — Work out what the system is, what it does and what needs protecting

B — Check that each threat has actually been mitigated, for example by testing

Section B: Match the Pairs

threat modelling → A structured way to work out what could go wrong with a system, before and during development, so risks can be dealt with early

Define → Identify and mitigate → Confirm → The three stages of threat modelling: describe the system, find threats and plan controls, then check the threats are actually dealt with

Threat modelling is done early and repeated, so it is reviewed whenever the design or the threats change → Review threat model: every sprint or design change

Threat modelling involves more than one role, such as developers, testers, security staff and the client → Participants: developers, testers, security, client

Run threat modelling once after the software is released, then never again → Threat modelling should be done early, before and during development, and repeated as the system changes. Doing it once after release finds problems too late and the model goes out of date.

Threat model stages: Define → Identify and mitigate → Release (no confirm step) → The final stage is confirm, not release. Without confirming, nobody knows whether the mitigations actually deal with the threats.

Section C: Definitions

threat modelling — A structured way to work out what could go wrong with a system, before and during development, so risks are found, fixed and confirmed early and then reviewed again.

Section D: Fill in the Blanks

STAGE 1 = DEFINE the system and its assets

STAGE 2 = IDENTIFY threats and mitigate them

STAGE 3 = CONFIRM threats are mitigated

WHEN: early in design, then repeat often

WHO: developers, testers and security staff

Section E: Spot the Error

A — The first stage of threat modelling is to define the system (its scope, assets and data flows), not to release it. Line 1 should be stage1 = 'define the system'.

B — The stages run in order: define, identify and mitigate, then confirm. Confirming before any threats have been identified makes no sense. Line 2 should be identify(system).

C — Threat modelling does not stop at finding threats. Each identified threat must be mitigated. Line 3 should be mitigate(threats).

A — A threat model is repeated while the system changes, so it needs a loop. An if statement would only review it once. Line 1 should be while system_in_development:.

D — Threats found early, during design, are cheaper and easier to fix than threats found after release. Line 4 should set cost_to_fix to 'low'.