Assets are what attackers want to affect
Threat modelling starts with what matters, not with what is vulnerable.
A list of assets is a list of things somebody would want to steal, alter, destroy or deny access to. Without it, analysis drifts towards whatever is technically interesting. With it, the question becomes concrete: how could somebody reach this, and what would stop them.
More on Threat modelling
- Attack trees decompose goals into possible pathsEvery way up the same hill
- Abuse cases describe intentional misuseIt worked perfectly
- Threat models expire as systems changeThe plan stopped growing
- Mitigations should connect to specific threatsEvery thread ends on a peg
- Threat models include failure without an attackerTwo ways the same mast falls
- Data-flow diagrams reveal hidden crossingsDraw the pipes, find the crossings