OIS-05.03B

The cloud service provider integrates threat intelligence insights into its risk management process (cf. OIS-07, OIS-08 and OIS-09).

Supplementary information

If a threat model is used for this process, the cloud service provider can, for example:

1. Use structured methodologies (e.g., STRIDE, PASTA, LINDDUN) appropriate to the cloud service architecture;

2. Map current threat landscape intelligence to specific system components, data flows, and trust boundaries;

3. Incorporate real-time threat intelligence to update threat models dynamically rather than relying on static annual assessments;

4. Consider emerging attack vectors, techniques, and procedures (TTPs) documented in frameworks such as MITRE ATT&CK; and

5. Account for supply chain and third-party risks through extended threat modelling.

The aim of threat modelling is to ensure that the current internal and external threats are reflected in risk handling measures.

1. Ħarsa ġenerali

1.1 Referenzi

1.2 Rekwiżiti identifikati

1.3 Regolamenti relatati

2. Rekwiżiti identifikati

3. Regolamenti relatati

Kwistjonijiet marbuta

• BSI -

  Copyright by Bundesamt für Sicherheit in der Informationstechnik (https://www.bsi.bund.de/)