Chapter 4

1. Spoofing, tampering, repudiation, information leak, Denial of Service, escalation of privilege.
2. From a risk standpoint, it is meant to identify the threats that are the most relevant to the product and test them. From a practical point of view, it allows the client to decide where to spend the testing budget in a way that covers the most important risks and helps us prioritize test scenarios.
3. Who, What, Where, Why, and How.
4. Yes and no; it depends on the following:

   a. The color of the approach (black, gray, or white) since that gives you a leg up compared to a more capable adversary.

   b. The time budget available. Being honest to your client and saying that you need more time because this specific test requires more effort is usually a reasonable way to go about this.

5. This is very important because problems WILL be found, in the system itself or in the components it relies on. From an impact perspective, if the system producer cannot patch a vulnerability...