Let's look at a case study to discuss the different approaches of threat modeling practices. Peter and Linda, who are security leads, plan to do threat modeling with a project team. Peter is in a very large organization. The project team is distributed across the Globe. The security process requires a formal threat modeling analysis report as parts of the criteria to move on to the next step. On the other hand, Linda is working with a small software company. Team members are all in the same location. Linda thinks using a whiteboard and card game discussion will be more interactive and efficient instead of detailed documents. As a result, Peter and Linda decided on different approaches to run the threat modeling as summarized in the following table:
|
|
Formal process (Peter) |
Group discussion (Linda) |
|
Characteristics |
... |
