Considerations Treat threat and adversary data with the utmost security. Ensure that any physical notes/drawings are erased and destroyed once digitally recorded. Ensure that any digital recordings of this process are kept secure and encrypted. Consider who has physical and visual access to the room where this process takes place, and if the room can be secured if this activity may span long/overnight breaks. Walkthrough Requires a process or data mapping exercise's outputs Threat Identification: (30 minutes per process) Give participants a "cheat sheet" of threats. Explain the types of threats. Confidentiality : If unauthorized individuals find out an asset/process exists. Control: If an asset/process can be accessed by unauthorized individuals. Integrity: If an asset/process is changed without permission. Availability: If an asset/process becomes unavailable. Consistency: If an asset/process becomes unreliable. (Some useIdentity instead or in addition to Consistency, if an asset/process can be spoofed to appear as owning/coming from someone else.) Auditability: If you cannot verify that an asset/process is secure. Identify a "interaction line" from the process map to start with. Generate a list of threats that would cause that interaction to fail. Mark the back of the post it with the interaction name or number. Write the threat and their impact on post-its and arrange them in an orderly way. If multiple risks cause the same consequence create a new post-it near the new risk. Continue doing this for all the interactions in the critical process'. Discuss and rearrange threats as groupings emerge. Label threat clusters that appear. NOTES: If any of the impacts identified in the pre-mortum or other process-mapping exercises are not covered ask participants where they would go. Take photos of the threats once you have finished enumerating them. Write risks on one set of post-its and impacts on another color of post-its to make it easy to keep track. Look at the"CVSS V2 Base Metrics" for an example of the severity of different threats. Page 153 of 240