Question

A risk analyst is conducting threat modeling for a new customer-facing web application that processes payment card data. During the exercise, the team has enumerated data flows, trust boundaries, and entry points. To ensure the resulting threat list is prioritized in a way that best supports risk assessment, what should the analyst do NEXT?

Accepted Answer

Rank each identified threat by the likelihood of exploitation and the potential business impact to the organization

Answer

Immediately implement compensating controls for every threat identified in the data flow diagram

Answer

Document all threats in the risk register and assign them equal weighting until controls are tested

Answer

Escalate the complete threat list to the board of directors for acceptance before further analysis