2 cissp ® Official Study Guide Eighth Edition

Performing Reduction Analysis
The next step in threat modeling is to perform reduction analysis. 
Reduction analysis
is 
also known as 
decomposing
the application, system, or environment. The purpose of this 
task is to gain a greater understanding of the logic of the product as well as its interactions 
with external elements. Whether an application, a system, or an entire environment, it 
needs to be divided into smaller containers or compartments. Those might be subroutines, 
modules, or objects if you’re focusing on software, computers, or operating systems; they 
might be protocols if you’re focusing on systems or networks; or they might be depart-
ments, tasks, and networks if you’re focusing on an entire business infrastructure. Each 
identified sub-element should be evaluated in order to understand inputs, processing, secu-
rity, data management, storage, and outputs.

---

Understand and Apply Threat Modeling Concepts and Methodologies 
37
In the decomposition process, you must identify five key concepts:
Trust Boundaries
Any location where the level of trust or security changes
Data Flow Paths
The movement of data between locations
Input Points
Locations where external input is received
Privileged Operations
Any activity that requires greater privileges than of a standard user 
account or process, typically required to make system changes or alter security
Details about Security Stance and Approach
The declaration of the security policy, secu-
rity foundations, and security assumptions
Breaking down a system into its constituent parts makes it much easier to identity the 
essential components of each element as well as take notice of vulnerabilities and points of 
attack. The more you understand exactly how a program, system, or environment operates, 
the easier it is to identity threats to it.