Skip to content

Commit 5738423

Browse files
authored
Update Threat_Modeling_Cheat_Sheet.md (#1522)
fix typo
1 parent 231ce8b commit 5738423

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

cheatsheets/Threat_Modeling_Cheat_Sheet.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,7 @@ Threat modeling requires a deep understanding of the system being evaluated. To
3737

3838
## Addressing Each Question
3939

40-
There is no universally accepted industry standard for the threat modeling process, no "right" answer for every use case. However, despite this diversity, most approaches do include the the processes of system modeling, threat identification, and risk response in some form. Inspired by these commonalities and guided by the four key questions of threat modeling discussed above, this cheatsheet will break the threat modeling down into four basic steps: application decomposition, threat identification and ranking, mitigations, and review and validation. There are processes that are less aligned to this, including PASTA and OCTAVE, each of which has passionate advocates.
40+
There is no universally accepted industry standard for the threat modeling process, no "right" answer for every use case. However, despite this diversity, most approaches do include the processes of system modeling, threat identification, and risk response in some form. Inspired by these commonalities and guided by the four key questions of threat modeling discussed above, this cheatsheet will break the threat modeling down into four basic steps: application decomposition, threat identification and ranking, mitigations, and review and validation. There are processes that are less aligned to this, including PASTA and OCTAVE, each of which has passionate advocates.
4141

4242
### System Modeling
4343

@@ -92,7 +92,7 @@ Finally, it is time to answer the question "did we do a good enough job"? The th
9292
- For each identified threat, has a response strategy been agreed upon?
9393
- For identified threats for which mitigation is the desired response, have mitigation strategies been developed which reduce risk to an acceptable level?
9494
- Has the threat model been formally documented? Are artifacts from the threat model process stored in such a way that it can be accessed by those with "need to know"?
95-
- Can the agreed upon mitigations be tested? Can success or failure of the requirements and recommendations from the the threat model be measured?
95+
- Can the agreed upon mitigations be tested? Can success or failure of the requirements and recommendations from the threat model be measured?
9696

9797
## Threat Modeling and the Development Team
9898

0 commit comments

Comments
 (0)