Which activity is a risk assessment approach that analyzes security of an application by capturing, organizing, and analyzing information that affects its security?

Which activity is a risk assessment approach that analyzes security of an application by capturing, organizing, and analyzing information that affects its security?

• A. Threat Modeling
• B. Incident Management
• C. Risk Management
• D. End of Line Comment

Answer: (A)

Threat modeling is a proactive risk assessment approach that analyzes the security of an application by capturing, organizing, and analyzing information that affects its security. It starts by identifying what needs protection (assets), how data flows through the system, and where trust boundaries exist. Then it catalogs potential threats and vulnerabilities, evaluates their likelihood and impact, and prioritizes mitigations. This structured analysis helps reveal the attack surface and informs secure design decisions, often using frameworks like STRIDE to categorize threats such as spoofing, tampering, information disclosure, and privilege escalation. Incident management deals with detecting, responding to, and recovering from security events after they occur, rather than modeling and mitigating threats upfront. Risk management is broader, addressing risks across an organization, not specifically the systematic threat-focused analysis of a single application's security. End of Line Comment is just a programming annotation and not a risk assessment activity.

Threat modeling is a proactive risk assessment approach that analyzes the security of an application by capturing, organizing, and analyzing information that affects its security. It starts by identifying what needs protection (assets), how data flows through the system, and where trust boundaries exist. Then it catalogs potential threats and vulnerabilities, evaluates their likelihood and impact, and prioritizes mitigations. This structured analysis helps reveal the attack surface and informs secure design decisions, often using frameworks like STRIDE to categorize threats such as spoofing, tampering, information disclosure, and privilege escalation.

Incident management deals with detecting, responding to, and recovering from security events after they occur, rather than modeling and mitigating threats upfront. Risk management is broader, addressing risks across an organization, not specifically the systematic threat-focused analysis of a single application's security. End of Line Comment is just a programming annotation and not a risk assessment activity.