2.4. Threat Modeling and Supply Chain Risk

💡 First Principle: Threat modeling makes threat analysis systematic rather than ad hoc — forcing security architects to enumerate all the ways a system could be attacked before it's built, when fixes are cheap, rather than after deployment, when fixes are expensive and disruptive.

Supply chain risk extends the threat model beyond the organization's direct control: if an attacker can't penetrate your systems directly, they'll compromise the hardware, software, or services you buy from others and use that access as a stepping stone. SolarWinds (2020) demonstrated that even security-conscious organizations are vulnerable to supply chain attacks targeting their trusted vendors.

Why this matters: Threat modeling and SCRM are increasingly weighted on modern CISSP exams as organizations recognize that perimeter-focused security fails when threats enter via trusted supply chain relationships. Questions will test when to apply which methodology and what controls address supply chain-specific risks.

⚠️ Common Misconception: Many candidates think air-gapped systems cannot be compromised remotely. Air gaps prevent direct network attacks, but supply chain attacks (compromised firmware or hardware before installation), removable media, and RF side-channel attacks have all been demonstrated against air-gapped systems. Stuxnet is the canonical example — delivered via USB to air-gapped Iranian nuclear centrifuge controllers.