ISC2 · CISSP
Threat modeling and supply chain risk
CISSP · Lesson 5 of 34 · 28:29
YouTube loads only after you press play. This chapter opens at its timestamp in the full course. Watch on YouTube ↗
In this lesson
Prepare for the ISC2 CISSP exam, on the 2027 outline. In this lesson: threat modeling methods (STRIDE, PASTA, DREAD), supply chain risks like tampering, counterfeits, and implants, third-party assessment, minimum security requirements, service-level requirements, silicon root of trust, physically unclonable functions, and SBOMs. Includes three original practice questions.
Preview the topics
- In a STRIDE review of the patient portal, the team finds that an attacker could change appointment data in transit. Which category is this?
- A new vulnerability is announced in a widely used logging library. What helps Larkspur find every affected application fastest?
- Switches bought from an unknown online reseller run unexpected firmware. Which practice would have reduced this risk most?