350-201 Question 171
Select 3A financial institution is developing a new web application that handles sensitive customer data such as account numbers and personal information. During the threat modeling process, the security team is tasked with identifying the key components of the system to analyze potential risks. Which of the following components should the team prioritize when building their threat model?
- A
The web server hosting the application
- B
The database storing customer data
- C
The physical security of the office facilities
- D
Third-party APIs integrated into the application
- E
Employee workstations used for internal communication
Show answer and explanation
Correct answers: A, B, D
Explanation
When analyzing components in a threat model, the focus should be on identifying and prioritizing elements that directly impact the security of the system being developed. In this scenario, the web server, customer database, and third-party APIs are critical components as they directly interact with the application and sensitive data. These elements are likely targets for attackers and require thorough security analysis. Physical security and employee workstations, while relevant in other contexts, are not the primary focus for this specific threat modeling exercise.
- A. Correct.
The web server hosting the application is a critical component since it is the gateway to the application and a common target for attackers. Any vulnerabilities in the server could potentially be exploited to gain unauthorized access.
- B. Correct.
The database storing customer data is a critical component because it contains sensitive information. Protecting the database from unauthorized access or data breaches is essential.
- C. Incorrect.
While physical security of the office facilities is important, it is not directly relevant to the software-based threat modeling process in this context.
- D. Correct.
Third-party APIs integrated into the application are important to analyze in a threat model, as vulnerabilities in these APIs could introduce risks that compromise the application’s security.
- E. Incorrect.
Employee workstations used for internal communication, while important in overall security, are not directly tied to the components of the web application being developed and analyzed in this specific threat model.