The business is designing a new customer-facing payment service. The information security manager wants the security requirements to reflect who is realistically likely to attack the service and how. Which activity BEST supports this goal?
Select an answer to reveal the explanation.
Short Explanation
If you're designing a bank vault, you'd want to know whether you're up against a pickpocket or a crew with a drill. Threat modeling asks who'd come after this service, why, with what skills, and through which doors. The trap is grabbing a familiar tool like a scan or a BIA that answers a different question.
Full Explanation
Threat modeling is the design-stage activity that identifies who might attack a system, what they want, what capabilities they bring and which paths they are likely to use. For a new payment service, that means considering financially motivated criminals, fraud rings, insiders and automated abuse, then mapping their probable vectors against the planned design so security requirements address realistic attacks rather than generic ones. The output feeds risk assessment and control selection. A vulnerability scan finds known technical weaknesses in systems that already exist; at design time there is little to scan, and scans say nothing about attacker motive or capability. A framework control catalog provides a useful baseline but is generic by design and does not reflect the specific actors targeting this service. A business impact analysis determines the consequences of disruption and sets recovery objectives; it addresses impact, not the identity or behavior of attackers. Exam caveat: threat modeling complements, rather than replaces, baseline controls and the business impact analysis. Operational check: confirm the design documentation contains a threat model listing actors and vectors, and that each high-priority threat traces to at least one security requirement.