Timeline for What is difference & link between threat modelling and vulnerability assessment?
Current License: CC BY-SA 4.0
5 events
when toggle format | what | by | license | comment | |
---|---|---|---|---|---|
Mar 10, 2021 at 14:20 | comment | added | Mike Ounsworth | @Kumar I don't know how to do this is general; I'm speaking from my experience as a developer asking the question "Is this CVE exploitable in our application?" which is often a lot of code reading and manual testing of our applications. | |
Mar 10, 2021 at 7:14 | comment | added | Kumar | We do calculate the CVSS environmental score based on the actual configuration of the vulnerable software, network topology, actual CIA impact etc. We do this by pulling up the software architecture, specs, discussion with dev team. But can threat models do this in a better way? Do you have any links/articles/papers which explains this in detail? We are also looking to automate these scorings. Would threat modelling help in that? | |
Mar 9, 2021 at 16:28 | history | edited | Mike Ounsworth | CC BY-SA 4.0 |
deleted 3 characters in body
|
Mar 9, 2021 at 16:23 | history | edited | Mike Ounsworth | CC BY-SA 4.0 |
deleted 3 characters in body
|
Mar 9, 2021 at 16:12 | history | answered | Mike Ounsworth | CC BY-SA 4.0 |