A CIO of a Health Care facility recently experienced theft of customer data. The CIO is focused on numerous potential threat vectors and wants to implement improved detection and possible mitigation…

Question

Options

• ADetermine the amount of funding available to make changes.
• BPerform vulnerability scans of every online asset.
• CIdentify where the protected data resides and how it is used.
• DDevelop stronger network security policies and procedures.

• A
  6% (1)
• B
  6% (1)
• C
  78% (14)
• D
  11% (2)

Explanation

Identifying where protected data resides and how it flows is the foundational step of any threat model - you cannot map attack surfaces, threats, or mitigations against data you haven't located. Healthcare environments (governed by HIPAA) require explicit data flow diagrams showing where PHI lives, who accesses it, and how it moves between systems before any meaningful threat analysis can occur.

Why the distractors fail:

• A (Funding): Budget assessment is a business decision, not a threat modeling step - you model threats first, then prioritize based on resources.
• B (Vulnerability scans): Scanning is a technical tool used after you know which assets to assess; running scans without knowing what data matters produces noise, not insight.
• D (Network policies): Writing policies is a mitigation output after threat modeling is complete - you can't write effective policy without first knowing what you're protecting.

Memory tip: Think "Find it before you fix it." Threat modeling always starts with asset/data identification - if you skip this step, every subsequent action (scanning, policy writing, funding requests) is directionless. The mnemonic "Where is the data?" is always Step 1.

No community discussion yet for this question.