Risk assessment
While threat modeling is a technical activity that is more objective in nature, using risk assessment is more subjective and tied to your priorities, needs, and sensitivities.
Integrating risk assessment to rank the threats
Risk assessment takes two main vectors into account—likelihood and damage:
- Likelihood: How likely is the threat to manifest? This takes into account how prized the result will be to an attacker and how easily they could get that result given your current defenses.
- Damage: What would be the actual impact if an attacker successfully manifested the threat? Would it create additional threats? Would it expose anything of value to theft or discovery?
An example of a common threat is an automated “bot” filling out and submitting a form to register as a website user.
For example, a decade ago, it was easy for people to buy tens of thousands of followers on social media sites to make themselves look influential...
