My understanding is that, threat modelling is used at the design stage to identify the possible threats, prioritize them and help in identifying security requirements/security controls. Vulnerability assessment is done during development and in maintenance also, where we scan the source code for vulnerabilities, prioritize and fix them. This link neatly explains my understanding.
But many other articles have put up the following ideas also.
- This link states CVSS as an threat modelling approach whereas CVSS is used in vulnerability assessment workflow to rate the vulnerability.
- Threat modelling can help in prioritizing vulnerabilities, focus on vulnerabilities which are most likely to affect your environment.
What is the link between vulnerability assessment and threat modelling? I am doing vulnerability assessment for OTS (off the shelf) software used in my system. I use CVSS 3.1 to score the vulnerability and prioritize fixing based on the score. In what way a threat model (like STRIDE or ATTACK TREE) can help in my vulnerability assessment.