Skip to content

Commit

Permalink
Update Threat_Modeling_Cheat_Sheet.md (#1522)
Browse files Browse the repository at this point in the history
fix typo
  • Loading branch information
xplo1t-sec authored Oct 31, 2024
1 parent 231ce8b commit 5738423
Showing 1 changed file with 2 additions and 2 deletions.
4 changes: 2 additions & 2 deletions cheatsheets/Threat_Modeling_Cheat_Sheet.md
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,7 @@ Threat modeling requires a deep understanding of the system being evaluated. To

## Addressing Each Question

There is no universally accepted industry standard for the threat modeling process, no "right" answer for every use case. However, despite this diversity, most approaches do include the the processes of system modeling, threat identification, and risk response in some form. Inspired by these commonalities and guided by the four key questions of threat modeling discussed above, this cheatsheet will break the threat modeling down into four basic steps: application decomposition, threat identification and ranking, mitigations, and review and validation. There are processes that are less aligned to this, including PASTA and OCTAVE, each of which has passionate advocates.
There is no universally accepted industry standard for the threat modeling process, no "right" answer for every use case. However, despite this diversity, most approaches do include the processes of system modeling, threat identification, and risk response in some form. Inspired by these commonalities and guided by the four key questions of threat modeling discussed above, this cheatsheet will break the threat modeling down into four basic steps: application decomposition, threat identification and ranking, mitigations, and review and validation. There are processes that are less aligned to this, including PASTA and OCTAVE, each of which has passionate advocates.

### System Modeling

Expand Down Expand Up @@ -92,7 +92,7 @@ Finally, it is time to answer the question "did we do a good enough job"? The th
- For each identified threat, has a response strategy been agreed upon?
- For identified threats for which mitigation is the desired response, have mitigation strategies been developed which reduce risk to an acceptable level?
- Has the threat model been formally documented? Are artifacts from the threat model process stored in such a way that it can be accessed by those with "need to know"?
- Can the agreed upon mitigations be tested? Can success or failure of the requirements and recommendations from the the threat model be measured?
- Can the agreed upon mitigations be tested? Can success or failure of the requirements and recommendations from the threat model be measured?

## Threat Modeling and the Development Team

Expand Down

0 comments on commit 5738423

Please sign in to comment.