The course teaches learners the process of threat modeling to analyze systems and identify weaknesses in design and missing security controls. The goal is to help participants understand techniques for identifying threats in systems. The course covers topics such as when and how to conduct threat modeling, scoping, creating models, identifying threats, and rating threat boundaries. The teaching method includes a talk introducing threat modeling and explaining various techniques. This course is intended for individuals interested in enhancing their system design and security skills, particularly those involved in system analysis and security control implementation.
Overview
Syllabus
Introduction
What do you do
How do we know
There is no free lunch
Flaws and bugs
Benefits of threat modeling
A quote from a participant
Threat modeling
When to do threat modeling
How to do threat modeling
S scoping
Models are wrong
Generic documentation
granularity
data flow diagrams
data movement
identifying threats
rating threat boundaries
focusing on flaws
finding threats
spoofing
tampering
integrity
information disclosure
denial of service
elevation of privilege
external entities
resources
threat modeling tool
rating threats
mitigations
Summary
Recommendation
Taught by
NDC Conferences
