The thesis deals with the area of computer security focusing on risk analysis methods aimed at the web-based software product development. 

The student will:

1. Evaluate existing threat modeling and risk assessment methodologies for web-based applications (at least STRIDE, PASTA, Attack Trees, Cyber Kill Chain, MITRE ATT&CK) and assess their effectiveness and practicality in conducting threat and risk assessments within agile development environments.

2. Review the existing Threat and Risk Assessment (TRA) methodology used by Siemens Healthineers and update it so that it protects from the Advanced Persistent Threats (APTs) and mitigate common software vulnerabilities in the context of agile software development. Use as much findings from the phase 1 as you can, with the outcome being a refined and updated TRA methodology (delivered in an Excel format).

3. Implement the updated TRA methodology on a real-world Siemens Healthineers software solution, address identified risks and vulnerabilities. Review the methodology's performance in practice, validate its effectiveness and practicality in agile environment against the expectations set in phase 2.