Which threat modeling step identifies the assets that need to be protected?

The "Analyze the Target" phase of threat modeling, often called "Decompose the Application," is where the system's architecture is broken down to be understood. A critical activity in this step is to identify the system's assets—the valuable data, processes, or resources that require protection. This involves creating diagrams (like Data Flow Diagrams) to visualize components, data flows, and trust boundaries. By identifying assets early in this analysis phase, security efforts can be properly focused on protecting what is most valuable to the organization and most attractive to an attacker.

A. Set the Scope: This step defines the boundaries of the threat model (what is in and out of scope) rather than identifying specific assets within the system.

C. Rate Threats: This step occurs later in the process to prioritize identified threats based on risk; it does not involve the initial identification of assets.

D. Identify and Document Threats: This step uses the system model (including its assets) to brainstorm potential threats (e.g., using STRIDE), but it follows the asset identification step.

1. Microsoft Security Development Lifecycle (SDL): In the official Microsoft threat modeling process, the second step is "Decompose the application." This step explicitly includes "identifying assets, trust boundaries, and entry/exit points" as part of understanding the application. This is synonymous with "Analyze the Target."

Source: Microsoft Docs, "Threat modeling process," Step 2: Decompose the application. (Retrieved from Microsoft's official documentation on the Security Development Lifecycle).

2. OWASP Threat Modeling Cheat Sheet: The OWASP methodology outlines a similar process. The first phase, "Decompose the Application," states that the goal is to understand the application, which involves identifying "entry points, assets, and trust levels."

Source: OWASP Foundation, "Threat Modeling Cheat Sheet," Section: "Phase 1 - Decompose the Application."

3. Academic Publication: The seminal book on the topic, Threat Modeling: Designing for Security, frames the process around four key questions. The first question, "What are we working on?", involves modeling the system. A core part of this modeling is understanding and listing the system's assets.

Source: Shostack, A. (2014). Threat Modeling: Designing for Security. Wiley. Chapter 3, "What Are You Building?", Section: "Assets."