Which threat modeling approach integrates risk assessment and risk prioritization with a structured modeling approach but is complex and lacks AI-specific threats?

Which threat modeling approach integrates risk assessment and risk prioritization with a structured modeling approach but is complex and lacks AI-specific threats?

• A. Trike
• B. LINDDUN
• C. VAST
• D. PASTA

Answer: (B)

A privacy-focused threat modeling approach that uses a structured data-flow modeling method and combines threat identification with risk assessment and prioritization is described here. LINDDUN fits this description. It uses data flow diagrams to map how data moves through a system and applies a privacy threat taxonomy to identify where privacy risks can arise across those flows. The threat categories—Linkability, Identifiability, Non-repudiation, Detectability, Disclosure, Unawareness, and Non-compliance—provide a clear, structured way to reason about different privacy risks in a system. Because it ties these identified threats to an assessment of likelihood and impact, it supports prioritizing which mitigations to implement based on the level of privacy risk. This makes the framework thorough and inherently complex, as it requires careful modeling of data flows and a comprehensive mapping to multiple privacy threats. It’s not tailored to AI-specific threats; rather, it focuses on privacy concerns inherent to data processing, which is why it’s described as lacking AI-specific threat coverage. Other approaches often emphasize broader security threats, faster or more lightweight modeling, or attack simulations, but they don’t center on the privacy-threat taxonomy within a structured data-flow model and explicit privacy risk prioritization in the same way LINDDUN does.

A privacy-focused threat modeling approach that uses a structured data-flow modeling method and combines threat identification with risk assessment and prioritization is described here. LINDDUN fits this description. It uses data flow diagrams to map how data moves through a system and applies a privacy threat taxonomy to identify where privacy risks can arise across those flows. The threat categories—Linkability, Identifiability, Non-repudiation, Detectability, Disclosure, Unawareness, and Non-compliance—provide a clear, structured way to reason about different privacy risks in a system.

Because it ties these identified threats to an assessment of likelihood and impact, it supports prioritizing which mitigations to implement based on the level of privacy risk. This makes the framework thorough and inherently complex, as it requires careful modeling of data flows and a comprehensive mapping to multiple privacy threats. It’s not tailored to AI-specific threats; rather, it focuses on privacy concerns inherent to data processing, which is why it’s described as lacking AI-specific threat coverage.

Other approaches often emphasize broader security threats, faster or more lightweight modeling, or attack simulations, but they don’t center on the privacy-threat taxonomy within a structured data-flow model and explicit privacy risk prioritization in the same way LINDDUN does.