Summary

This was the last of the TRIM categories; the threats covered on the cards were from the Minimization suit of the Elevation of Privacy extension card deck. These threats look at the usage of the data, its relevance, and limiting the amount of data collected to only that absolutely necessary to perform the service or task it was supplied for.

Throughout the book, we have covered threats from the different categories of STRIDE, privacy, and TRIM. The threats on the cards we have covered are not an exhaustive list of all possible threats, but they are some of the more common ones, and understanding them will help you enormously when threat modeling. You should also have a better understanding of the privacy regulations and, as a consequence, your own rights as well. Threat modeling should be performed during the requirements and design phase and may save you costly rework later, but don’t forget that a threat model is also a living document that should be updated regularly...