Summary

At the beginning of this chapter, we learned about threat, vulnerability, and risk and their relationship with each other. We then learned about threat modeling, the importance of threat modeling in the software development life cycle, and the important threat modeling practices used in the industry. After, we switched gears to learn more about vulnerabilities, vulnerability and control analysis, sources of vulnerabilities, and how to start a vulnerability management program from scratch.

In the next chapter, we will learn about risk assessment concepts, standards, and frameworks.