Threat Modeling Essentials (201)
Self-Paced Course
The threat landscape is continuously evolving. New attacks and vulnerabilities emerge nearly everyday, making it challenging to build secure systems. This is why we threat model.
Threat modeling is the "measure twice, cut once" of cybersecurity. It's a structured process that helps you see the big picture, so you can create targeted defense strategies. By methodically analyzing components, data flows, trust boundaries and more, threat modeling reveals security design flaws and high-risk areas.
The key benefits of threat modeling include:
This self-paced version of 'Threat Modeling Essentials' is a focused course perfect for busy security architects, software developers, product managers, and more, looking to develop fundamental skills to find and mitigate threats systematically. You will learn to visualize systems, map data flows, understand vulnerabilities and recommend mitigations.
The Threat Modeling Essentials course is designed to provide attendees the ability to more consistently and efficiently apply threat modeling using the Four Question Framework:
Course content
What to expect
Participants will complete 7 chapters; 1 preparation, 5 knowledge and skills, and a bonus chapter. The 6 core chapters each include a set of video lectures (about 5 minutes each) and exercises to build the skills covered in the lectures. The bonus chapter has 1 additional reading and 2 videos of 45 minutes each.
Learning outcomes
After taking Threat Modeling Essentials, participants will have the knowledge and skills to consistently and efficiently use the Four Question Framework, data flow diagrams, STRIDE to identify threats, mitigation techniques, document results, and advance threat modeling results for action.
These techniques will enable participants to identify threats and mitigation techniques, document results, and advance threat modeling results for action.
Timing
Enrollment in this course is active for 30 days.
Estimated time to complete is 6-13 hours.
The estimated time range is based on the minimum and maximum time recommendations for completing exercises and engagement with optional materials. The average time to complete is closer to 10 hours.
Welcome to Threat Modeling
Syllabus
Slide Book (downloadable)
Exercise Book (downloadable)
Learning Online
Exercise: Drawing tools
The Question: What Are We Working On?
DFDs: Diagrams and Models
Trust Boundaries (Introduction)
Exercise: Data Flow Diagram Essay
Exercise: Data Flow Diagram Creation
Models (answer key)
Exercises: Trust Boundaries Essay
Exercise: Draw Trust Boundaries
Exercise: Stop and Reflect
What Can Go Wrong? Brainstorming
STRIDE (Introduction)
Applying STRIDE
Tracking Threats & Assumptions
Exercise: STRIDE Essay
Exercise: Apply STRIDE
Final Tips & Recap: What Can Go Wrong
Exercise: Stop and Reflect
Mitigations
Addressing Threats
Exercise: Design Control - Broadly
Exercise: Design Controls in Depth
Exercise: Stop and Reflect
Did we do a good job?
Retrospectives
Exercise: Stop and Reflect
Make Threat Modeling Part of Your Work
Exercise: Final Homework
Self-paced Course
Add the physical threat modeling physical toolkit
Everything you need to complete the course is included, but some people want or need more. That's why we have put together a physical engagement pack the includes:
Take your threat modeling knowledge to the next level with a 60-minute, 1-on-1 video consultation with threat modeling expert Adam Shostack.
In your course wrap up session Adam will answer your questions and provide tailored guidance to address your specific goals. You can pick Adam's brain on topics like:
During your course wrap up, Adam Shostack will draw from his deep expertise in threat modeling and security design to focus wholly on your needs. As an industry pioneer, Adam authored the popular book Threat Modeling: Designing for Security as well as the recent Threats: What Every Engineer Should Learn from Star Wars. He also led the creation of the widely-used SDL Threat Modeling Tool and helped establish global security standards like CVE. With decades of experience in the field, including pioneering the Elevation of Privilege threat modeling game, Adam will work to strengthen your own skills and understanding of this critical discipline. Let his substantial background in establishing threat modeling practices, authoring key texts, and pushing the industry forward guide the session and empower you in your own security journey.
You can add your course wrap up with Adam for just $295 during checkout.
Participants will deepen knowledge + skills needed to consistently and efficiently utilize threat modeling to identify threats, mitigation techniques, document results, deliver more secure products, and champion threat modeling within organizations.
$899
Includes: On-line course, printed slide and exercise books, reusable sketch book, DFD stencil, EoP card deck, and STRIDE wallet card.
$962
Includes: On-line course, course wrap-up with Adam Shostack, printed slide and exercise books, reusable sketch book, DFD stencil, EoP card deck, and STRIDE wallet card.
$1,257
Includes: On-line course, a reusable sketch book, DFD stencil, EoP card deck, and STRIDE wallet card.
$936
Includes: On-line course and printed slide and exercise books.
$925
No worries. You can still purchase a course wrap up with Adam Shostack at the regular price of $450. https://courses.shostack.org/courses/threat-modeling-essentials-course-wrap-up-with-adam
Yes. You can purchase the physical toolkit here: https://courses.shostack.org/courses/physical-toolkit And you can purchase the course books here: https://courses.shostack.org/courses/essentials-course-books