Adversary Modeling, Risk, and Security Metrics
From Threats to Measurable Risk
Threat Modeling
Threat modeling is the process of identifying assets, entry points, adversaries, and plausible attack paths. For advanced practitioners, the goal is not merely to list threats, but to derive actionable controls and measurable residual risk.
Risk Vocabulary
Qualitative vs Quantitative Risk Analysis
Qualitative
- Uses categories such as high/medium/low
- Useful when data is sparse
Quantitative
- Uses numerical estimates and distributions
- Supports cost-benefit optimization
In risk analysis, what does residual risk mean?
Residual risk is the remaining risk after security controls reduce the original exposure.
Correct answer: Risk remaining after controls and mitigations
Give one example of a useful security metric for an enterprise program.
Operational metrics such as detection and response times help evaluate control effectiveness over time.
Correct answer: Mean time to detect or mean time to respond.
Threat Modeling Workflow
-
1
Step 1: Identify critical assets and security goals.
-
2
Step 2: Enumerate entry points and data flows.
-
3
Step 3: Model adversaries, capabilities, and incentives.
-
4
Step 4: Rank threats by impact and likelihood.
-
5
Step 5: Map mitigations to the highest-risk scenarios.
Advanced Tip
Good metrics are decision-oriented: if a metric does not change resource allocation, architecture, or operations, it is probably not worth tracking.
Which metric is most directly tied to response efficiency after compromise detection?
Mean time to respond measures the interval between detection and containment/recovery activities.
Correct answer: Mean time to respond
Uncertainty and Bayesian Reasoning
Advanced risk work often benefits from probabilistic reasoning. When empirical data is limited, Bayesian methods allow analysts to update prior beliefs as evidence accumulates, producing more disciplined estimates than intuition alone.