Security: Threats & Defense · Study deck
Threats Route Map
Picture a freezer alarm that reaches the dashboard but never reaches the nurse on duty.
Shield Shelly is your guide for this deck.
After studying this chapter
Learning objectives
You will be able to:
- Explain: A gateway means the device or service that joins one network or system to another, so it is one boundary to inspect rather than proof that the whole path works.
- Explain: If a control has been proposed, jump to segmentation, secure boot, updates, protocol security, monitoring, or the relevant practice chapter and ask what record would prove the control works.
- Explain: This proves one alarm path under the tested conditions, not that every security threat is controlled; the deeper route map links each failure to the right review.
- Explain: This route map keeps that story in order.
Major section
Start With the Failed Alarm
A gateway means the device or service that joins one network or system to another, so it is one boundary to inspect rather than proof that the whole path works.
- This proves one alarm path under the tested conditions, not that every security threat is controlled; the deeper route map links each failure to the right review.
- The dashboard says everything is fine, but the box arrived spoiled.
- This route map keeps that story in order.
Major section
First Name the Thing That Could Be Hurt
Its output is a prioritised list of threats, each paired with a mitigation.
- Identity and action also depend on authentication, authorization, accountability, and sometimes non-repudiation.
- A framework called STRIDE turns the vague "how might this be attacked?" into a systematic checklist that keeps those distinct failure modes visible.
Major section
First Name the Thing That Could Be Hurt (continued)
For an IoT product, that route keeps the review tied to observable work.
- A cold-chain gateway, for example, might protect shipment temperature readings, command topics, device credentials, and audit records.
- If the learner cannot name the asset or boundary, start with foundations.
- Intuition: threat modelling is a pre-mortem.
Major section
First Name the Thing That Could Be Hurt (continued)
The first question is not whether the design has "security", but which of those assets crosses a trust boundary and what failure would harm the mission.
- If the asset is clear but the failure modes are vague, move to threat modeling and STRIDE.
- If the likely weakness is already known, use the attack and vulnerability chapters.
- If a control has been proposed, jump to segmentation, secure boot, updates, protocol security, monitoring, or the relevant practice chapter and ask what record would prove the control works.
Major section
Use STRIDE to Turn Worry Into Rows
Information disclosure asks which field is sensitive, where it is stored, who can read it, and whether transport and at-rest controls are both relevant.
- A practitioner pass should turn each category into a local question.
- If any row cannot name evidence, it is still a hypothesis.
- Each threat now has a concrete, checkable control.
Major section
Rank the Exposed Paths Before You Build Controls
A threat model is only useful if it drives the right work, and a few principles keep it grounded.
- Reducing the attack surface (fewer exposed interfaces, closed ports) removes threats outright rather than merely mitigating them.
- Prioritise by risk Not all threats are equal.
- If one layer is bypassed, the next still stands.
Major section
Rank the Exposed Paths Before You Build Controls (continued)
In a resource-constrained IoT design, reducing that surface can be more reliable than adding compensating controls everywhere.
- Defence in depth Layer controls so no single failure is fatal: authentication, encryption, least privilege, monitoring.
- Segmentation, least privilege, and logging limit how far an attacker who gets in can spread and how long they go unnoticed.
- Prioritisation is also more than a red-yellow-green label.
Deck summary
Key takeaways
A gateway means the device or service that joins one network or system to another, so it is one boundary to inspect rather than proof that the whole path works.
- Its output is a prioritised list of threats, each paired with a mitigation.
- For an IoT product, that route keeps the review tied to observable work.
- The first question is not whether the design has "security", but which of those assets crosses a trust boundary and what failure would harm the mission.
- A threat model is only useful if it drives the right work, and a few principles keep it grounded.
Retrieval practice
Recall check 1 of 4
Shield Shelly says: answer from memory, then check your reasoning.
Q1A learner says a device is secure because it uses a network segmentation control. What is the best next review question?
Show answer
Answer: A The strongest review path ties each control to an asset, threat, boundary, and validation record.
Retrieval practice
Recall check 2 of 4
Shield Shelly says: answer from memory, then check your reasoning.
Q2What are the three properties of the CIA triad that security aims to protect?
Show answer
Answer: C The CIA triad is Confidentiality (secrecy), Integrity (data unaltered), and Availability (accessible when needed).
Retrieval practice
Recall check 3 of 4
Shield Shelly says: answer from memory, then check your reasoning.
Q3In STRIDE, an attacker altering data in transit is which threat, and which property does it violate?
Show answer
Answer: A In STRIDE, tampering (altering data) violates Integrity; signatures, MACs, or authenticated encryption (AEAD) mitigate it.
Retrieval practice
Recall check 4 of 4
Shield Shelly says: answer from memory, then check your reasoning.
Q4A threat model lists 40 possible threats. With limited time, how should the team decide what to address first?
Show answer
Answer: D Ranking by risk (likelihood times impact) directs limited effort to the threats most likely to occur and most damaging, rather than treating all 40 equally.
Print reference
Answers
Answer key.
- A · The strongest review path ties each control to an asset, threat, boundary, and validation record.
- C · The CIA triad is Confidentiality (secrecy), Integrity (data unaltered), and Availability (accessible when needed).
- A · In STRIDE, tampering (altering data) violates Integrity; signatures, MACs, or authenticated encryption (AEAD) mitigate it.
- D · Ranking by risk (likelihood times impact) directs limited effort to the threats most likely to occur and most damaging, rather than treating all 40 equally.