Find the threats before you write the code. This one-day course covers STRIDE methodology, PASTA framework, attack trees, data flow diagrams, trust boundaries and hands-on threat modeling for web applications, APIs and microservices. You leave with a threat model template and the skills to use it.
A practical threat modeling course for developers. Every module builds toward the capstone: producing a complete threat model document. (Times are approximate.)
Threat modeling is not just for security teams. Developers who threat model write more secure code because they understand the attack surface before writing the first line. This module makes the case with real examples of vulnerabilities that threat modeling would have caught at design time.
STRIDE (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege) is the most widely used threat modeling framework. Apply STRIDE to each element in a system: processes, data stores, data flows, and external entities. Work through a complete example from diagram to threat list.
Process for Attack Simulation and Threat Analysis (PASTA) is a risk-centric threat modeling framework. Walk through all seven stages, from business objective definition through attack simulation. Understand when PASTA is more appropriate than STRIDE (when business risk drives the analysis).
Attack trees decompose a threat goal into the steps an attacker would take. Build attack trees for common goals: steal user credentials, exfiltrate data, achieve remote code execution. Use attack trees to identify the most likely and most impactful attack paths.
Data flow diagrams (DFDs) are the foundation of most threat modeling approaches. Draw DFDs at Level 0 (context) and Level 1 (detailed). Identify and mark trust boundaries. Every element that crosses a trust boundary needs security controls. Practice drawing DFDs for real applications.
The attack surface is everything an attacker can interact with: endpoints, protocols, file formats, APIs, configuration, dependencies, and human interfaces. Systematically enumerate the attack surface of a sample application. Understand attack surface reduction as a design principle.
Apply STRIDE to a three-tier web application: browser frontend, API backend, and database. Draw the DFD, identify trust boundaries, enumerate threats, and prioritize by risk. Produce a threat model document that a development team can act on.
APIs have a different threat profile than web applications. Apply STRIDE to a REST API: authentication, authorization, input validation, rate limiting, and inter-service communication. Cover API-specific threats: BOLA, mass assignment, and excessive data exposure.
Microservices distribute the attack surface. Threat model service-to-service communication, service mesh trust, secret distribution, and the blast radius of a single compromised service. Cover the unique challenges: lateral movement, confused deputy, and shared data stores.
A threat model is only useful if it is documented and maintained. Cover the standard threat model document structure: scope, DFD, threat list, mitigations, residual risks, and assumptions. Build a template that works for your team.
Threat modeling does not have to be a heavyweight process. Cover lightweight approaches: 15-minute threat modeling for new features, threat modeling as part of design review, and maintaining the threat model as the system evolves. Make it a habit, not a ceremony.
Given a system architecture description, produce a complete threat model: DFD, trust boundaries, STRIDE analysis, prioritized threats, and recommended mitigations. Present your threat model and defend your prioritization. Debriefed as a group.
Review the threat modeling methodology, templates, and checklists you take away. Cover how to champion threat modeling in your organization and how to train your team.
One day of hands-on threat modeling for developers. STRIDE, PASTA, attack trees, data flow diagrams and applied threat modeling for web apps, APIs and microservices.
Corporate and sovereign cohorts, and bespoke on-site delivery, on request.