Question

A security architect is building a threat model for a new customer-facing web application. During a design review, the team has produced a data flow diagram, identified trust boundaries, and applied STRIDE to each element. A junior analyst asks what specific value enumerating the application's entry points (login forms, APIs, file upload endpoints, and third-party integrations) adds to the threat model. Which statement best describes the purpose of enumerating these components?

Accepted Answer

It defines the attack surface, allowing the team to reason about where an adversary could interact with the system and where threats should be prioritized

Answer

It calculates the residual risk score for each asset so that cyber insurance coverage can be accurately priced

Answer

It produces the CVSS base metrics needed to rank discovered vulnerabilities by severity

Answer

It replaces the need for a data flow diagram by mapping all internal component-to-component traffic