2.5 Explain concepts related to vulnerability response, handling, and management.
📘CompTIA CySA+ (CS0-003)
Definition:
Threat modeling is a structured process used by IT teams to identify, assess, and prioritize potential security threats to systems, applications, or networks before they can be exploited by attackers. Think of it as a proactive way to find weak spots in IT systems and plan how to defend them.
The main goal of threat modeling is to understand what can go wrong and implement measures to reduce risk.
Why Threat Modeling Matters
- Helps prevent security breaches by addressing risks early.
- Guides developers and system administrators in building secure systems.
- Helps organizations prioritize vulnerabilities based on impact and likelihood.
- Supports compliance and audits by showing that risks have been analyzed.
Steps in Threat Modeling
Most organizations follow a structured approach. The main steps are:
1. Identify Assets
- Determine what you are trying to protect.
- Examples in IT:
- User data (personal info, passwords)
- Databases
- Servers and virtual machines
- Network devices
- Applications
Tip for exam: Assets are anything valuable that, if compromised, could harm your organization.
2. Identify Threats
- Look at all possible ways attackers could harm your systems.
- Common IT threats include:
- Malware: Viruses, ransomware affecting servers
- Phishing attacks: Targeting employees to steal credentials
- Unauthorized access: Hackers exploiting weak passwords
- Denial-of-service (DoS): Overloading a network or server
- Insider threats: Employees misusing system access
Tip for exam: Think of threats as the “what could go wrong?” part.
3. Identify Vulnerabilities
- Vulnerabilities are weaknesses that make threats possible.
- Examples in IT:
- Outdated software or unpatched servers
- Weak passwords
- Misconfigured firewalls or network devices
- Open ports that shouldn’t be accessible
Tip for exam: Threats exist everywhere, but vulnerabilities are what make attacks succeed.
4. Analyze and Prioritize Risks
- Determine how likely each threat is and the potential impact.
- High-risk threats are addressed first.
- Example of prioritization in IT:
- A web server running outdated software with public access → high priority
- Internal workstation with up-to-date antivirus → lower priority
Common Frameworks:
- DREAD – Damage, Reproducibility, Exploitability, Affected Users, Discoverability
- STRIDE – Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege
These frameworks help categorize and assess risks clearly.
5. Mitigation Planning
- Plan how to reduce or eliminate risks.
- IT mitigation strategies:
- Patch vulnerable software and systems
- Apply strong access controls and multi-factor authentication
- Encrypt sensitive data
- Monitor networks for unusual activity
6. Review and Update
- Threat modeling is not a one-time task.
- Systems and applications change, so threats need continuous reassessment.
- Regular reviews help ensure new vulnerabilities are identified and mitigated.
Common Threat Modeling Approaches in IT
- Asset-Centric Approach
- Focuses on the most valuable assets first.
- Example: Protecting database servers before endpoints.
- Attacker-Centric Approach
- Focuses on the perspective of an attacker.
- Example: What would a hacker try to exploit first in your network?
- Software-Centric Approach
- Focuses on application or software security.
- Example: Identifying vulnerabilities in a web application or API.
Key Terms to Remember for the Exam
- Threat: Anything that can harm your IT system.
- Vulnerability: A weakness that can be exploited.
- Risk: The likelihood of a threat exploiting a vulnerability.
- Mitigation: Steps to reduce risk.
- Asset: Anything valuable to protect.
Quick Example in IT Terms (for Understanding)
- Asset: Employee database
- Threat: Hacker stealing credentials
- Vulnerability: SQL injection in login page
- Risk: High, because sensitive data is exposed
- Mitigation: Use parameterized queries and input validation
This shows how threat modeling guides actionable security measures in real IT environments.
✅ Exam Tips
- Understand the purpose and benefits of threat modeling.
- Know the common frameworks (DREAD, STRIDE).
- Be able to identify assets, threats, vulnerabilities, and mitigation strategies.
- Remember it’s a continuous process, not a one-time task.
- Focus on IT examples rather than abstract or physical examples.
