Architects debating a new permitting portal disagree: one wants STRIDE-style threat categories; another says abuse cases are unnecessary because 'users are mostly honest.' What should the program choose?
Select an answer to reveal the explanation.
Short Explanation
Hoping residents are angels is not a methodology. Structured categories—STRIDE-style or similar—force you to walk spoofing, tampering, and the rest before go-live. Optimism is lovely; checklists catch the crooks.
Full Explanation
Structured threat-modeling methodologies—whether STRIDE-style categories, abuse cases, or equivalent—should drive design reviews for a permitting portal rather than optimism that users are mostly honest. Honest majority traffic does not eliminate adversarial or accidental misuse; portals that handle identity, documents, payments, and approvals are attractive targets. Skipping modeling, limiting analysis to natural disasters only, or substituting a one-time password length increase for architecture review leaves trust-boundary and abuse-path gaps unexamined. A program that chooses structured methods produces repeatable findings, clearer control requirements, and better audit evidence than hope-based assurance. Exam caveat: CISSP secure design principles include threat modeling as a deliberate practice; assumptions about user virtue are not a control. Operational check: pick a documented methodology, apply it to data flows and trust boundaries for the portal, record abuse cases and mitigations, and require updates when features change. Train architects and developers on the chosen method so reviews are consistent across municipal applications. Track open threat-model findings to closure before major releases.