Which threat modeling technique involves identifying security controls and countermeasures to mitigate threats?

A threat modeling matrix is a structured tool used to systematically document and analyze threats against system assets or components. A key function of this matrix is to map identified threats to specific security controls and countermeasures designed for mitigation. This approach provides a clear, organized view of the threat landscape and the corresponding protective measures, making it the technique that directly involves identifying security controls. Other methods like DFDs and STRIDE are typically used as inputs for populating the matrix.

A. Data flow diagrams: These are used to visualize system data paths and trust boundaries to identify where threats might occur, but they do not inherently identify security controls.
C. SWOT analysis: This is a high-level strategic planning tool for analyzing Strengths, Weaknesses, Opportunities, and Threats, not a technical method for defining specific system security countermeasures.
D. STRIDE model: This is a mnemonic (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege) used to categorize and identify potential threats, not to determine the controls to mitigate them. ---

1. Official Vendor Documentation: Cisco. (2021). Cisco Secure Development Lifecycle (CSDL) Threat Modeling. Cisco White Paper. This document outlines the CSDL process where the output of threat modeling is a documented list of threats and their corresponding mitigations. This structured list functions as a threat matrix, directly linking threats to the controls that mitigate them. (Reference: See section "Threat Modeling Process," Step 4: "Identify Mitigations").

2. University Courseware: Bauer, L. (2021). 15-326/15-626/18-732: Software Security - Lecture 4: Threat Modeling. Carnegie Mellon University, School of Computer Science. The lecture notes illustrate the threat modeling process where, after identifying threats (using methods like STRIDE), they are documented in a table (a matrix format) that includes columns for the threat, risk rating, and required mitigations/controls. (Reference: Slide 24, "Example Threat Model").

3. Peer-reviewed Academic Publications: UcedaVelez, T., & Morana, M. M. (2015). A Process for Attack Simulation and Threat Analysis. In Risk Centric Threat Modeling (pp. 143-210). John Wiley & Sons, Inc. This foundational work on the PASTA methodology describes Stage V: Threat Analysis, which involves creating a threat tree and mapping threats in a matrix that is then used in Stage VI: Vulnerability & Weakness Analysis to identify necessary controls. (Reference: Chapter 5, Section "Stage V: Threat Analysis").