Hands-On Threat Modeling

Threat modeling (also known as architecture risk analysis) is the primary security analysis task performed during the software design stage. It is a structured activity for identifying and evaluating application threats and related design flaws. You use the identified flaws to adapt your design, or scope your security testing.

Threat modeling allows you to consider, identify, and discuss the security implications of user stories in a structured fashion, and in the context of their planned operational environment.This threat modeling crash course will teach you to perform threat modeling through a series of exercises, where our trainer will guide you through the different stages of a practical threat model based on a migration from a “classical” web application to a combination of AWS hosted microservices.

In this workshop you will learn an iterative and incremental threat modeling method that you can integrate in your development and deployment pipeline. This method allows you to consider security issues at your application and component levels.

Exercises are built upon a fictional Acme Hotel Booking (AHB) system, where we migrate a legacy client-server system towards a cloud based, micro service stack using AWS services.

What you’ll learn and how you can apply it
By the end of this course, you’ll understand:

Where threat modeling fits in a secure development lifecycle
The benefits of threat modeling
The different stages of threat modeling
The STRIDE model (spoofing, tampering, repudiation, information disclosure, denial of service, elevation of privilege)
Secure design mitigations
Risk rating
And you’ll be able to:

Create and update your own threat models with an incremental technique
Identify design flaws in your software
Use threat modeling as an awareness tool for your team and stakeholders
Get your team on the same page with a shared vision on security
This course is for you because…
You’re an application security champion, software architect or IT security specialist
You work with development and DevOps teams to increase software assurance and resilience
You want to become an application security expert
Prerequisites
Familiarity with core principles of software engineering, software security, microservices, cloud architectures and AWS.