I personally believe that the distinction you perc...

2009-06-12T05:48:01.284-05:00

I personally believe that the distinction you perceive at the beginning of this post - that is, financial sector threat modeling vs. technology sector threat modeling - is not a real difference but just a side-effect of the nature of the two sectors.

All threat modeling is done for a business reason - you don't do threat modeling to produce nice wallpapers or to be kind to your neighbor, you do it to meet a certain business goal. It is essential, then, that threat modeling begins with the "business goals"->"business risk"->"technical risk" mapping step that you are talking about. All threat models should in fact start like this. However, for software vendors - like Microsoft - the technical risks happen to overlap with the business risks, and that's why IMHO you see this step missing in the MS-sanctioned way of doing threat modeling.

In other words, when you do threat modeling for a bank, you need to start from the business goals and business risks in order to understand that a certain database is an asset to protect. On the other hand, when you do threat modeling of a system being sold by a software vendor, you already know that whatever user data gets touched by that system, it'll be an asset to protect.

My two cents.

Comments on radi::blog: Threat modeling: bringing it all together

I personally believe that the distinction you perc...