Security Starts with Risk Assessment and Threat Modelling

It is not feasible to eliminate all risk from a system. Security investments are balanced against the effect of undesirable outcomes. Balancing must be grounded in a realistic assessment of the threats, the risks they pose and how they might prevent the system from fulfilling its intended functions. Costs must be evaluated and a rational selection of implementation choices made to deliver an acceptable return on investment.

Risk is a function of the likelihood of a threat event’s occurrence and potential adverse impact should the event occur.

This talk will provide examples of Internet of Things hacks, an overview of the Risk Assessment process, IoT Attack Surface and Vectors and the tools that you can use to undertake your Threat Analysis which can assist you in developing your test plans.

• You need to evaluate the risk and incorporate security at the Requirement and Design Phase.
• Risk is a function of the likelihood of a threat event’s occurrence and potential adverse impact should the event occur.
• Use risk and threat analysis to: understand the risks; define your security design requirements; mitigate the threats and assist you in developing your test plans.