Is Threat Risk Assessment the same as Threat Risk Modeling?

Question

I've been asked to help fill out a survey and one of the questions is whether a Threat Risk Assessment has been performed on a blog we're setting up for a charity. The WordPress blog will use a free theme. It will be administered by a 5 content admins, but otherwise, there's no password protected content, and all information is publicly available.

I'm not familiar with Threat Risk Assessment, so I did a search on google. I see there are some industry known practices for Threat Risk Modeling, like STRIDE and DREAD. Is Threat Risk Modeling meant to mean the same thing as Threat Risk Assessment? In which case, I can reply by saying we will hire someone to do a DREAD Threat Risk Assessment? Is threat risk assessment the same as threat risk modeling?

Answer 1

Risk Assessment is described as

Risk assessment determines the value of the information assets, identifies the applicable threats and vulnerabilities that exist (or could exist), identifies the existing controls and their effect on the risk identified, determines the potential consequences and finally prioritizes the derived risks and ranks them against the risk evaluation criteria set in the context establishment.

in the ISO/IEC 27005:2011.

A Threat Risk Assessment does exactly that, but with focus on threats towards an organization/system/software (whatever you set as your scope).

To give an example, if you would perform a TRA for your blog an outcome might be:

Asset: webserver

Threat: abuse of rights

Vulnerability: All admins have access to the admin control panel (or whatever this is called in wordpress)

Control: Gee, I don't know?!?

Effect on Risk: lowers likelihood by X%

Now you are done with the risk assessment (in a nutshell). After you have completed this for all your assets within the chosen scope, you model your threats. This means, that you try to 'think' like an attacker who wants to harm you/your system. How would he/she try to accomplish his/her goal? If you can't do that yourself, you hire a consultant, an IT-security expert or you visit Sec.SE and ask a question:

You: "Heyyy guyzz, how would an admin abuse his rights, if he was, like, an admin on my blog?" (not you obviously)

You get a sophisticated answer that describes how this admin would do that.

Sec.SE: "Oftentimes administrators have more rights, than they need. Imagine a team of - let's say - 5 admins. Each admin has a specific role. Admin A is responsible for uploading new content, Admin B is responsible for moderating comments, Admin C is responsible for maintaining the database and so on. This obviously means, that each admin should only have the rights, that he/she definitely needs to have. You should definitely restrict the rights for admins in a way, that they are only allowed to do things, that they have to, according to their roles.

Now you have modelled(!) a threat and also established a control. Congratulations!