Threat Modeling, Supply Chain Risk, and Security Awareness

Introduction

This lesson closes Domain 1, Security and Risk Management (16% of the exam, ISC2 exam outline effective 15 April 2024). Lesson 3 taught you to measure and treat risk. Here you learn three practices that feed and support that risk work: threat modeling (finding what can go wrong with a system before attackers do), supply chain risk management (controlling the risk that comes from suppliers, hardware, and software you did not build), and security awareness, education, and training (making people part of the control set).