This presentation looks at steps taken and tools used to build Chevron's security architecture. Covered are high level principles that guide the architecture and tools, namely threat modeling, attack graphs and (quantitative) risk assessment. These tools detail potential threats/risks and help identify mitigating controls. Included is an example of selecting controls to address targeted attacks.