There are many risk assessment guidelines such NIST800-30 and ISO 27005 that provide a catalogue of known threats as reference. Using a qualitative approach, I selected one threat events catalogue and I tried to select the threats that are applicable to my use case.
To my understanding, by studying the system design specifications, I can compile a list of threats that may affect the system. However, I want to be more deterministic in my approach and say if the system is vulnerable to my compiled threats or not.
My approach is to look at the current security controls deployed on the system, and by analysing these controls I can say "System is vulnerable to threat X, Y and Z". I know I kind of have an answer to my question, but maybe there is a more methodological / organized approach? Having a list of known threats, how can I determine if a system is vulnerable or not?
PS: I am more interested on a qualitative approach, I know a vulnerability tool can make life easier.