When evaluating security threats, consider who can perform the attack, what the attack can do, and where the attack can be performed. Assessing these factors can help determine the actual impact and practicality of the threats.