Arrange these threat-modeling activities in a sensible sequence.

### The order 1. **Identify assets and the system's data flows**: You need to know what matters and how it moves before examining attack paths. 2. **Identify where a threat actor could interact with the system**: These interaction points help reveal possible entry routes. 3. **Consider threats and weaknesses at those interaction points**: This connects an attacker capability to a possible vulnerability. 4. **Identify possible harm and choose controls to reduce it**: Controls should address the risks identified in the earlier steps. ### Terms - **Threat modeling**: A structured examination of possible attacks, their effects, and ways to reduce risk. - **Data flow**: The movement of information through a system. ### Remember Trace what matters, where it can be reached, and what harm could follow.