App Security Engineer Threat Modeling Flashcards

What is the primary goal of threat modeling?

Answer: To identify and mitigate security risks early

Threat modeling helps identify security risks early in the software development lifecycle to mitigate potential threats before deployment.

Which of the following is a widely used threat modeling framework?

Answer: STRIDE

The STRIDE model categorizes threats into Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege.

Why is data flow analysis important in threat modeling?

Answer: It identifies vulnerabilities in data transmission and storage

Analyzing data flow helps identify potential security vulnerabilities at various points where data is transmitted, processed, or stored.

Which threat category in STRIDE involves unauthorized data modification?

Answer: Tampering

Tampering occurs when an attacker modifies data to alter its integrity, leading to compromised security.

What is the primary benefit of implementing threat modeling in the early stages of development?

Answer: It reduces the cost of fixing security issues

Early threat modeling reduces the cost and effort of fixing security vulnerabilities compared to addressing them post-deployment.

Which security principle is essential in mitigating threats identified in threat modeling?

Answer: The principle of least privilege

The principle of least privilege ensures that users and processes have only the necessary permissions, minimizing potential attack vectors.