Outline a basic threat modeling approach?

Outline a basic threat modeling approach?

• A. Only list threats and implement patches.
• B. Build a security architecture without considering risks.
• C. Identify assets, enumerate potential threats, assess vulnerabilities, evaluate impact, and define mitigations with a risk-based prioritization.
• D. Focus on incident response only.

Answer: (C)

Threat modeling is a proactive, structured approach to security that starts with what you’re protecting and what could go wrong, then prioritizes mitigations based on risk. The best option outlines five essential steps: identify assets, enumerate potential threats, assess vulnerabilities, evaluate impact, and define mitigations with a risk-based prioritization. Identifying assets ensures you know what matters; enumerating threats lets you consider attacker goals and methods; assessing vulnerabilities reveals weaknesses that could be exploited; evaluating impact helps quantify consequences to the organization; and defining mitigations with risk prioritization focuses efforts on the most significant risks rather than just chasing threats or reacting after incidents. The other choices are too narrow: focusing only on listing threats and patches neglects asset context and risk; building security architecture without considering risks ignores which threats matter most; and concentrating on incident response alone is reactive and misses preventive protections.

Threat modeling is a proactive, structured approach to security that starts with what you’re protecting and what could go wrong, then prioritizes mitigations based on risk. The best option outlines five essential steps: identify assets, enumerate potential threats, assess vulnerabilities, evaluate impact, and define mitigations with a risk-based prioritization. Identifying assets ensures you know what matters; enumerating threats lets you consider attacker goals and methods; assessing vulnerabilities reveals weaknesses that could be exploited; evaluating impact helps quantify consequences to the organization; and defining mitigations with risk prioritization focuses efforts on the most significant risks rather than just chasing threats or reacting after incidents. The other choices are too narrow: focusing only on listing threats and patches neglects asset context and risk; building security architecture without considering risks ignores which threats matter most; and concentrating on incident response alone is reactive and misses preventive protections.