In threat modeling, how should risk-based mitigations be prioritized?

In threat modeling, how should risk-based mitigations be prioritized?

• A. Ignore risk and implement all mitigations equally.
• B. Prioritize mitigations based on cost alone.
• C. Prioritize mitigations based on likelihood and impact; focus on highest risk assets.
• D. Prioritize mitigations based on regulatory requirements only.

Answer: (C)

When prioritizing mitigations in threat modeling, you assess risk as a combination of how likely a threat is to succeed and how much damage it would cause. The best approach is to focus on the highest-risk assets and apply mitigations where they deliver the most risk reduction. In practice, this means evaluating both the probability of a threat and the potential impact if it occurs, then directing effort and resources to those areas with the greatest combination of likelihood and consequence. This ensures that protections are proportional to the danger they prevent and that scarce security resources have the biggest effect. Choosing to ignore risk and implement everything equally wastes time and money because not all threats pose the same danger. Relying on cost alone can mislead you into protecting low-impact or unlikely scenarios while neglecting more serious ones. Basing priorities solely on regulatory requirements may protect against certain mandates but can leave more significant, real-world risks unaddressed.

When prioritizing mitigations in threat modeling, you assess risk as a combination of how likely a threat is to succeed and how much damage it would cause. The best approach is to focus on the highest-risk assets and apply mitigations where they deliver the most risk reduction. In practice, this means evaluating both the probability of a threat and the potential impact if it occurs, then directing effort and resources to those areas with the greatest combination of likelihood and consequence. This ensures that protections are proportional to the danger they prevent and that scarce security resources have the biggest effect.

Choosing to ignore risk and implement everything equally wastes time and money because not all threats pose the same danger. Relying on cost alone can mislead you into protecting low-impact or unlikely scenarios while neglecting more serious ones. Basing priorities solely on regulatory requirements may protect against certain mandates but can leave more significant, real-world risks unaddressed.