Threat Modeling and Vulnerability Identification
Threat modeling and vulnerability identification
This domain tests whether you can model threats before scanning, map findings to assets and business context, and distinguish a vulnerability from a risk. Expect STRIDE, attack trees, data-flow diagrams, trust boundaries, CVSS, CVE/CWE, authenticated scanning, and false-positive validation.
Core rules
- Model the system: assets, entry points, data flows, trust boundaries, and attacker goals. STRIDE gives a checklist (spoofing, tampering, repudiation, information disclosure, denial of service, elevation).
- Identify vulnerabilities with the right depth: authenticated scans reveal patch and configuration issues that unauthenticated scans miss; manual checks validate business logic.
- Score with context. CVSS base score measures technical severity, not business risk. Adjust for exposure, data sensitivity, compensating controls, and exploit availability.
- Map to ATT&CK tactics to show realistic attack paths; record evidence and false-positive disposition.
Worked example
An HR portal uses SSO but sets a session cookie without Secure and HttpOnly. STRIDE flags information disclosure and spoofing at the browser trust boundary. A scanner reports a medium CVSS score. Reasoning: the cookie can leak over HTTP or via XSS, enabling session hijacking of HR records. Because the asset holds personal data and is internet-facing, likelihood and impact are higher than the base score suggests. You verify with a test account, capture the Set-Cookie header, and rate risk as high with remediation: set both flags, force HTTPS, rotate sessions on login.
Traps
- Presenting scanner output as a threat model.
- Rating every critical CVE as critical risk without asset context.
- Missing trust boundaries between web, app, and database tiers.
- Ignoring authenticated scan credentials and then claiming “no findings.”
- Failing to validate false positives and false negatives.
- Confusing threat, vulnerability, and risk in the report.