Threat Modeling for Builders Workshop

This workshop introduces you to some of the background of threat modeling and why to do it, as well as some of the tools and techniques for modeling systems, identifying threats, and selecting mitigations. The workshop guides you through the process of creating a system model and corresponding threat model. Then you assess the usefulness of these models. Each exercise has step-by-step instructions as you progress through the workshop.

• Course level: Intermediate
• Duration: 6 hours

Activities

This course includes information presentations, interactive elements, and hands-on exercises.

Course objectives

In this course, you will learn:

• What threat modeling is and why it is useful
• How to model a system using a data flow diagram
• How to use a data flow diagram to find useful threats to a system
• How to identify mitigations for threats and how to choose between them
• How to evaluate the effectiveness of your models

Intended audience

This course is intended for:

• Software Developers
• Product Managers
• Systems Engineers
• Architects

Prerequisites

None  

Course outline

Module 1: Features

• Navigating the Course

Module 2: Start Here

• Course Overview
• Quiz: Course Overview
• Introduction to Threat Modeling
• Quiz: Introduction to Threat Modeling
• Threat Modeling at AWS
• Quiz: Threat Modeling at AWS
• Case Study

Module 2: What Are We Working On?

• What Are We Working On?
• Quiz: What Are We Working On?
• Exercise: Create a Data Flow Diagram
• Debrief: What Are We Working On?

Module 3: What Can Go Wrong?

• What Can Go Wrong?
• Quiz: What Can Go Wrong?
• Threat Grammar
• Quiz: Threat Grammar
• Exercise: Find Threats
• Debrief: What Can Go Wrong?

Module 4: What Are We Going to Do About It?

• What Are We Going to Do About It?
• Quiz: What Are We Going to Do About It?
• Exercise: Select Risk Response Strategies
• Debrief: What Are We Going to Do About It?

Module 5: Did We Do a Good Enough Job?

• Did We Do a Good Enough Job?
• Exercise: Assess the Usefulness of the Process

Module 6: Conclusion

• Final Knowledge Check
• Resources
• Conclusion
• Feedback