What is the third step for constructing a threat model for identifying a spoofing threat?
A) Define the assets
B) Identify potential threats
C) Identify potential vulnerabilities
D) Rate the threats