Security-MD-TM-Threat Modeling Overview

Overview

Threat modling is a type of security analysis:

• Analysis Target: representations of a system
• Analysis Goal: highlight concerns about security and privacy characteristics.

There are 4 key questions in threat modeling:

1. What are we working on? (Target)
2. What can go wrong? (Threat Analysis)
3. What are we going to do about it? (Mitigation based on the analysis results)
4. Did we do a good enough job? (Validation)

Why Threat Modeling?

• The output of threat modeling is threats.
• These threats can be used to drive subsequent design, development, testing and postdeployment phases.