authorized user interaction with the system is diagrammed simultaneously
with the hostile user’s interactions. Where the connections between actor and
actions in a use case are labeled with terms like “extends” and “includes,” the
connections in a misuse case are labeled “threatens” and “mitigates.” Misuse