16.14: Conduct Threat Modeling

Control Statement

Conduct threat modeling. Threat modeling is the process of identifying and addressing application security design flaws within a design, before code is created. It is conducted through specially trained individuals who evaluate the application design and gauge security risks for each entry point and access level. The goal is to map out the application, architecture, and infrastructure in a structured way to understand its weaknesses.

[csf.tools Note: For more information on the Critical Security Controls, visit the Center for Internet Security.]