CISSP Practice Question: A financial services company is integrating a new mobile banking application. The…

Correct Answer: B. Engage in a threat modeling exercise

Explanation (CISSP Manager Logic):

Threat modeling is a proactive strategic activity that identifies potential attack vectors and design flaws early in the lifecycle. This allows the CISO to align security requirements with business objectives and user experience before committing resources to specific technical controls.

By engaging in threat modeling, you:

• Identify application-specific risks based on the unique architecture.
• Prioritize security investments based on actual business impact.
• Facilitate "security by design" to reduce long-term remediation costs.

While the other options are relevant, they fall short because:

• A: Penetration testing is a reactive, point-in-time detective control typically performed later in the development cycle.
• C: MFA is a specific technical control that may be necessary but does not address broader architectural vulnerabilities.
• D: Policy reviews ensure administrative compliance but fail to identify technical threats unique to a new mobile platform.

Think like a manager:

Prioritize proactive risk identification over reactive testing. Effective security management starts with understanding the specific threat landscape to inform all subsequent technical and financial decisions.