SDL Threat Modeling & Risk Assessment — Questions and Answers

Question 1: What is the main purpose of threat modeling in software development?

To design user interfaces.
To identify security threats and mitigate risks (Correct answer)
To speed up deployment.
To write code faster.

Correct answer: To identify security threats and mitigate risks

The main purpose of threat modeling in software development is to systematically analyze an application or system to identify potential security threats, vulnerabilities, and attack vectors. By understanding these risks, development teams can then design and implement appropriate security controls and mitigations. This proactive approach helps build security into the design from the outset, rather than trying to patch it later.

Question 2: Which technique is commonly used for systematic threat modeling?

PERT.
STRIDE (Correct answer)
Gantt chart.
Fishbone diagram.

Correct answer: STRIDE

STRIDE is a widely recognized and systematic methodology for threat modeling, developed by Microsoft. It categorizes threats into six types: Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege. Using STRIDE helps teams methodically identify and classify potential threats against different components of a system, guiding the selection of appropriate countermeasures.

Question 3: What does the 'D' in STRIDE stand for?

Denial of Service (Correct answer)
Data theft.
Debugging.
Deployment.

Correct answer: Denial of Service

In the STRIDE threat modeling methodology, 'D' stands for Denial of Service. This category of threats aims to make a system or resource unavailable to its legitimate users, often by overwhelming it with traffic or exploiting vulnerabilities. Identifying potential Denial of Service attacks during threat modeling allows developers to design systems that are resilient to such attacks, ensuring continuous availability.

Question 4: Why is risk assessment important after threat modeling?

To ignore low priority risks.
To prioritize and manage risks effectively (Correct answer)
To delay project deadlines.
To reduce software quality.

Correct answer: To prioritize and manage risks effectively

After identifying potential threats through threat modeling, risk assessment is crucial to evaluate the likelihood and impact of each identified risk. This process allows teams to prioritize risks based on their severity and potential consequences. Effective risk assessment enables informed decision-making on which risks require immediate mitigation, which can be accepted, or which need further monitoring.

Question 5: What is an attack surface in threat modeling?

The project schedule.
All points vulnerable to attack (Correct answer)
The project budget.
The team size.

Correct answer: All points vulnerable to attack

In threat modeling, the attack surface refers to the sum of all points or vectors where an unauthorized user can try to enter or extract data from an environment. This includes all exposed interfaces, protocols, services, and code paths that could be exploited by an attacker. Identifying and minimizing the attack surface is a key strategy for reducing security risks.

Question 6: Which is a key output of risk assessment?

Final project report.
Risk register (Correct answer)
Budget forecast.
User manuals.

Correct answer: Risk register

A key output of risk assessment is the risk register, which is a detailed document that lists all identified risks, their potential impact, likelihood, priority, and proposed mitigation strategies. It serves as a central repository for tracking and managing risks throughout the project lifecycle. The risk register helps stakeholders understand the overall risk posture and guides decision-making.

Question 7: What is residual risk?

Risk before mitigation.
Risk transferred to another party.
Risk remaining after mitigation (Correct answer)
Risk accepted by stakeholders.

Correct answer: Risk remaining after mitigation

Residual risk refers to the level of risk that remains after all planned security controls and mitigation strategies have been implemented. It's the risk that an organization accepts because it's either too costly or impossible to eliminate entirely. Understanding residual risk is important for ongoing risk management and for making informed decisions about acceptable risk levels.

Question 8: Why is documentation critical in threat modeling?

It is optional.
It supports communication and traceability (Correct answer)
It increases workload unnecessarily.
It delays project deployment.

Correct answer: It supports communication and traceability

Documentation is critical in threat modeling because it provides a clear record of the identified threats, vulnerabilities, mitigation strategies, and the rationale behind decisions. This documentation supports effective communication among team members and stakeholders, ensuring everyone understands the security posture. It also provides traceability, allowing teams to revisit and update the threat model as the system evolves.

Question 9: Which stakeholder is typically responsible for managing identified risks?

End users.
Project manager (Correct answer)
Vendors.
Testers only.

Correct answer: Project manager

The project manager is typically responsible for overseeing the overall risk management process, including managing identified risks. While security specialists identify and assess risks, the project manager integrates risk mitigation activities into the project plan, allocates resources, and ensures that risks are tracked and addressed throughout the project lifecycle. They are accountable for the project's success, which includes managing its risks.

SDL Threat Modeling & Risk Assessment

What is the main purpose of threat modeling in software development?