CISSP Crash Course - Threat Modeling

The video tutorial covers threat modeling, a process to identify and predict potential threats to systems or architectures. It explains the differences between pre-deployment and post-deployment threat modeling, and discusses various methods for identifying threats, including asset-oriented, attacker view, and software threats. The tutorial introduces threat modeling techniques like STRIDE and PASTA, and explains how to diagram threat models and use tools for threat identification. Finally, it covers prioritizing threats using systems like DREAD and implementing appropriate controls to mitigate them.

Explain the difference between pre-deployment and post-deployment threat modeling.

What is the primary goal of threat modeling?

How can threat modeling help reduce costs in system development?

What are the two perspectives from which threats can be identified?

Describe the STRIDE model and its components.

What is the purpose of the DREAD rating system in threat modeling?

What steps should be taken after identifying threats in a threat model?