Security: Threats & Defense · Study deck
Threats Route Map
Picture a freezer alarm that reaches the dashboard but never reaches the nurse on duty.
Shield Shelly is your guide for this deck.
After studying this chapter
Learning objectives
You will be able to:
- Explain: A gateway means the device or service that joins one network or system to another, so it is one boundary to inspect rather than proof that the whole path works.
- Explain: This proves one alarm path under the tested conditions, not that every security threat is controlled; the deeper route map links each failure to the right review.
- Explain: Information disclosure asks which field is sensitive, where it is stored, who can read it, and whether transport and at-rest controls are both relevant.
- Use practice and visual-resource chapters after the core evidence path is clear.
Major section
Start With the Failed Alarm
A gateway means the device or service that joins one network or system to another, so it is one boundary to inspect rather than proof that the whole path works.
- This proves one alarm path under the tested conditions, not that every security threat is controlled; the deeper route map links each failure to the right review.
- The dashboard says everything is fine, but the box arrived spoiled.
- This route map keeps that story in order.
Major section
First Name the Thing That Could Be Hurt
Its output is a prioritised list of threats, each paired with a mitigation.
- Identity and action also depend on authentication, authorization, accountability, and sometimes non-repudiation.
- A framework called STRIDE turns the vague "how might this be attacked?" into a systematic checklist that keeps those distinct failure modes visible.
- If the learner cannot name the asset or boundary, start with foundations.
Major section
First Name the Thing That Could Be Hurt (continued)
If the likely weakness is already known, use the attack and vulnerability chapters.
- For an IoT product, that route keeps the review tied to observable work.
- A cold-chain gateway, for example, might protect shipment temperature readings, command topics, device credentials, and audit records.
- Intuition: threat modelling is a pre-mortem.
Major section
Use STRIDE to Turn Worry Into Rows
Information disclosure asks which field is sensitive, where it is stored, who can read it, and whether transport and at-rest controls are both relevant.
- A practitioner pass should turn each category into a local question.
- If any row cannot name evidence, it is still a hypothesis.
- Each threat now has a concrete, checkable control.
Major section
Rank the Exposed Paths Before You Build Controls
A threat model is only useful if it drives the right work, and a few principles keep it grounded.
- Reducing the attack surface (fewer exposed interfaces, closed ports) removes threats outright rather than merely mitigating them.
- Prioritise by riskNot all threats are equal.
- If one layer is bypassed, the next still stands.
Major section
Rank the Exposed Paths Before You Build Controls (continued)
In a resource-constrained IoT design, reducing that surface can be more reliable than adding compensating controls everywhere.
- Defence in depthLayer controls so no single failure is fatal: authentication, encryption, least privilege, monitoring.
- Segmentation, least privilege, and logging limit how far an attacker who gets in can spread and how long they go unnoticed.
- Prioritisation is also more than a red-yellow-green label.
Deck summary
Key takeaways
A gateway means the device or service that joins one network or system to another, so it is one boundary to inspect rather than proof that the whole path works.
- Its output is a prioritised list of threats, each paired with a mitigation.
- If the likely weakness is already known, use the attack and vulnerability chapters.
- Information disclosure asks which field is sensitive, where it is stored, who can read it, and whether transport and at-rest controls are both relevant.
- A threat model is only useful if it drives the right work, and a few principles keep it grounded.
Retrieval practice
Recall check 1 of 3
Shield Shelly says: answer from memory, then check your reasoning.
Q1A learner says a device is secure because it uses a network segmentation control. What is the best next review step?
Show answer
Answer: C The strongest review path ties each control to an asset, threat, boundary, and validation record.
Retrieval practice
Recall check 2 of 3
Shield Shelly says: answer from memory, then check your reasoning.
Q2What are the three properties of the CIA triad that security aims to protect?
Show answer
Answer: D The CIA triad is Confidentiality (secrecy), Integrity (data unaltered), and Availability (accessible when needed).
Q3In STRIDE, an attacker altering data in transit is which threat, and which property does it violate?
Show answer
Answer: C In STRIDE, tampering (altering data) violates Integrity; signatures, MACs, or authenticated encryption (AEAD) mitigate it.
Retrieval practice
Recall check 3 of 3
Shield Shelly says: answer from memory, then check your reasoning.
Q4A threat model lists 40 possible threats. With limited time, how should the team decide what to address first?
Show answer
Answer: A Ranking by risk (likelihood times impact) directs limited effort to the threats most likely to occur and most damaging, rather than treating all 40 equally.
Print reference
Answers
Answer key.
- C · The strongest review path ties each control to an asset, threat, boundary, and validation record.
- D · The CIA triad is Confidentiality (secrecy), Integrity (data unaltered), and Availability (accessible when needed).
- C · In STRIDE, tampering (altering data) violates Integrity; signatures, MACs, or authenticated encryption (AEAD) mitigate it.
- A · Ranking by risk (likelihood times impact) directs limited effort to the threats most likely to occur and most damaging, rather than treating all 40 equally.