Which approach collects and analyzes information that affects the security of an application to identify threats and mitigation strategies?

Which approach collects and analyzes information that affects the security of an application to identify threats and mitigation strategies?

• A. Risk Management
• B. Incident Management
• C. Threat Modeling
• D. End of Line Comment

Answer: (C)

Threat modeling concentrates on gathering and analyzing information about an application's security to identify threats and outline mitigation strategies. It involves mapping the architecture, data flows, assets, and trust boundaries, then pinpointing where weaknesses could be exploited and what safeguards are needed. Techniques like STRIDE help categorize potential threats, guiding the selection of security requirements and design changes early in development. While risk management looks at broader organizational risks and incident management focuses on responding after incidents occur, threat modeling specifically targets an application's design to uncover threats and plan protections from the outset.

Threat modeling concentrates on gathering and analyzing information about an application's security to identify threats and outline mitigation strategies. It involves mapping the architecture, data flows, assets, and trust boundaries, then pinpointing where weaknesses could be exploited and what safeguards are needed. Techniques like STRIDE help categorize potential threats, guiding the selection of security requirements and design changes early in development. While risk management looks at broader organizational risks and incident management focuses on responding after incidents occur, threat modeling specifically targets an application's design to uncover threats and plan protections from the outset.