Threat Modeling & Risk Assessment Flashcards

An application allows users to upload XML files that are parsed server-side. Which threat should be the HIGHEST priority in the threat model?

Answer: XML External Entity (XXE) injection

Server-side XML parsing of user-supplied content is the textbook XXE scenario, where malicious entity references can exfiltrate files or trigger SSRF.

In the VAST (Visual, Agile, and Simple Threat modeling) methodology, threat models are divided into which two types?

Answer: Application and operational threat models

VAST distinguishes Application Threat Models (for developers, focused on design) from Operational Threat Models (for infrastructure and DevOps teams).

Which metric in CVSS v3 reflects the degree to which the exploited component can affect components beyond its security scope?

Answer: Scope

The Scope metric captures whether exploitation of one component can impact resources managed by a different security authority (Changed vs. Unchanged).

What is the recommended action when a threat identified in a threat model cannot be mitigated due to technical or business constraints?

Answer: Document the threat as accepted risk with a named approver and review date

SDL requires formally documenting accepted risks with an accountable approver and a scheduled review date rather than silently ignoring unmitigated threats.

A financial application processes payment data and logs full credit card numbers to a debug log file. Under STRIDE, which two threats are MOST directly present?

Answer: Information Disclosure and Repudiation

Logging PAN data exposes sensitive information (Information Disclosure), and the logs could allow users to deny transactions if log integrity is not assured (Repudiation).

Which practice ensures that third-party and open-source components are included in the SDL threat model scope?

Answer: Software Composition Analysis (SCA) integrated with the threat model

SCA tools inventory all third-party components and their known vulnerabilities, ensuring the threat model reflects risks from the full dependency tree.

When applying the STRIDE-per-Element approach, which element type is typically associated with the FULL set of STRIDE threats?

Answer: Processes

Processes can be subject to all six STRIDE threats because they execute logic, handle identity, read/write data, perform logging, transmit data, and hold privileges.