In threat modeling using STRIDE, mapping assets to threats helps with what?

• A. Prioritize mitigations based on risk
• B. Increase system complexity
• C. Remove risk entirely
• D. Ignore data integrity

Answer: (A)

In STRIDE threat modeling, mapping assets to threats is a tool for risk-based decision making. By linking what you’re protecting (assets) to the potential threats that could affect them (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege), you can see which threats pose the greatest risk to the most important assets. This makes it possible to prioritize mitigations where they will reduce risk the most, focusing resources on the gaps that would have the biggest impact if exploited.

Remember that risk isn’t eliminated—mitigations reduce it to an acceptable level. Mapping also ensures you don’t ignore important concerns like data integrity, because threats to confidentiality, integrity, and availability are all considered for each asset.