The Complete Metasploit Guide

Threat modeling

Threat modeling helps in conducting a comprehensive penetration test. This phase focuses on modeling out true threats, their effect, and their categorization based on the impact they can cause. Based on the analysis made during the intelligence gathering phase, we can model the best possible attack vectors. Threat modeling applies to business asset analysis, process analysis, threat analysis, and threat capability analysis. This phase answers the following set of questions:

• How can we attack a particular network?
• To which critical sections do we need to gain access?
• What approach is best suited for the attack?
• What are the highest-rated threats?

Modeling threats will help a penetration tester to perform the following set ...