Practical Internet of Things Security - Second Edition

Step 6 – rate the threats

Evaluating the likelihood and impact of each of the previous threats allows for selecting appropriate types and levels of control (and their related costs) to mitigate each. Threats with higher risk ratings may require larger amounts of investment to mitigate. Conventional threat-rating methodologies can be used at this step, including Microsoft's DREAD approach.

The DREAD model asks basic questions for each level of risk and then assigns a score (1 to 10) for each type of risk that emerges from a particular threat:

• Damage: This is the amount of damage incurred by a successful attack
• Reproducibility: What level of difficulty is involved in reproducing the attack?
• Exploitability: Can the attack be easily exploited ...