Step 5. Document the Threats

To document the threats of your application, use a template that shows several threat attributes similar to the one below. The threat description and threat target are essential attributes. Leave the risk rating blank at this stage. This is used in the final stage of the threat modeling process when you prioritize the identified threat list. Other attributes you may want to include are the attack techniques, which can also highlight the vulnerabilities exploited, and the countermeasures that are required to address the threat.

Table 3.4: Threat 1

Threat Description	Attacker obtains authentication credentials by monitoring the network
Threat target	Web application user authentication process
Risk
Attack techniques	Use of network monitoring software
Countermeasures	Use SSL to provide encrypted channel

Table 3.5: Threat 2

Threat Description	Injection of SQL commands
Threat target	Data access component
Risk
Attack techniques	Attacker appends SQL commands to user name , which is used to form a SQL query
Countermeasures	Use a regular expression to validate the user name, and use a stored procedure that uses parameters to access the database.