Reviewing the Trike threat model and use cases
The Trike threat model is focused on the objective of threat modeling from a risk standpoint. This type of threat model is typically paired with risk registries so that it can be targeted to the specific risks and needs that you perceive. Most of the time, these threat models are tied to auditing or compliance requirements, and they are based on the specific requirements of the organization. It combines those requirements with risk owners and establishes the level of acceptable risk. It differs from the PASTA and STRIDE models because it is a risk-based approach instead of utilizing the systems and attack approach of the other models. The point of this model is to accomplish the following:
- Communicate what the risks are within the organization
- Determine the acceptable risk threshold with input from all stakeholders for the organization
- Establish the risk owners for the applicable risks, to be held accountable for mitigations...
