DREAD measures threat severity using five scoring factors.

OCTAVE focuses more on technical vulnerabilities than organizational risks.

RMF’s “Monitor” step occurs after system authorization.

Spoofing refers to unauthorized data modification.

A vulnerability alone already causes risk even without threats.

Backups are considered preventive controls.

Impact refers to how likely an attack will occur.

Antivirus software is designed primarily as a preventive control.

Attack Trees visually show multiple possible attack paths.

MFA is an example of a corrective control.

Discoverability measures how easy it is to detect an attack after it occurs.

RMF requires selecting controls before implementing them.

Information disclosure involves modifying stored data.

Phishing emails represent vulnerabilities in an organization.

Assets are any resources requiring protection.

A failed login attempt is automatically a threat.

DREAD’s Affected Users factor considers the number of impacted individuals.

OCTAVE evaluates asset value during the assessment.

Preventive controls detect anomalies.

Tampering refers to altering data without authorization.

RMF’s “Authorize” step guarantees security forever.

Threats and vulnerabilities must both exist to produce risk.

Cost-benefit analysis ensures that only cheap controls are selected.

PASTA simulates possible attacker activities.

Attack Trees give details on financial impacts of risks.

Repudiation means denying involvement in an action.

DREAD’s Damage Potential measures how destructive a threat can be.

Monitoring logs is a detective control.

Risk identification includes locating possible weaknesses.

NIST RMF requires ongoing monitoring of controls.

Backups restore systems after incidents.

A threat cannot exist without vulnerabilities.

Attack Trees use a root node to represent the final attacker objective.

Impact refers to potential consequences of a threat.

User training is considered a detective control.

STRIDE is most often used for system design threat modeling.

The OCTAVE model is typically used by small home users.

Vulnerabilities always come from external attackers.

RMF requires implementing controls before assessing them.

Cost-benefit analysis measures if a control’s advantages exceed its total cost.

Spoofing includes pretending to be another user.

Discoverability measures how easy it is to find a weakness.

A risk with low impact can still be considered high priority.

STRIDE includes Denial of Service as one category.

OCTAVE only applies to physical security threats.

Detective controls help discover unusual or unauthorized activity.

Impact assessment happens before vulnerability identification.

An asset must always be a physical device.

Backups are essential for critical systems to minimize data loss.