During the threat modeling process for a new application that a company is launching, a security analyst needs to define methods and items to take into consideration. Which of the following are part of a known threat modeling method?

Question

Accepted Answer

C. Spoofing tampering, repudiation, information disclosure, denial of service elevation of privilege Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege (STRIDE) are the six categories of threats defined by the STRIDE threat modeling methodology, developed by Microsoft, which helps analysts systematically identify potential weaknesses in an application.

Answer

A. Threat profile, infrastructure and application vulnerabilities, security strategy and plans While these are relevant security considerations, they do not represent a specific, named threat modeling method like STRIDE.

Answer

B. Purpose, objective, scope, (earn management, cost, roles and responsibilities These are typically elements of project management or risk assessment, not a specific threat modeling methodology's threat categories.

Answer

D. Human impact, adversary's motivation, adversary's resources, adversary's methods These describe elements of adversary profiling, which can inform threat modeling but are not the categories of a known, named threat modeling method itself.

During the threat modeling process for a new application that a company is launching, a security analyst needs to define methods and items to take into consideration. Which of the following are part o

Question

Options

How the community answered

Why each option

Topics

Community Discussion