TEMPLATE 222: Threat Modeling Intensive

Participants will deepen knowledge + skills needed to consistently and efficiently utilize threat modeling to identify threats, mitigation techniques, document results, deliver more secure products, and champion threat modeling within organizations.

Threat modeling intensive

Our most popular course

For technology professionals looking to deliver secure systems, threat modeling is an essential skillset. Learn from Adam Shostack, who wrote the most popular book on the topic. August 29 - Sep 2 9AM-11AM Pacific. Equivalent to a 2 day in-person course, 20 hours including classes and homework.

Begin Course

Every participant receives

printed and electronic copies of:

Slidebook (125 pages, spiral bound)
Elevation of Privilege game
Exercises booklet
Threat modeling stencil
Whiteboard sketchbook

Course curriculum

1. Welcome
2. Download the course syllabus
3. Update Your Calendar
4. Join Slack
1. Download the Slide Book
2. Download the Exercise Book
3. Preparing to learn using distributed learning
4. Learning in A Distributed Course (Tips)
5. Introduction to the LMS
6. How we use Zoom
7. How We Use Slack
8. Readiness Survey
9. How we use Google Documents
1. Exercise: Propose a System for Analysis
2. Exercise: Drawing tools (optional)
1. Monday Live Class Zoom Link
1. The Question: What Are We Working On?
2. DFDs: Diagrams + Models
3. Exercise: Data Flow Diagram Essay
4. Exercise: Data Flow Diagram Creation
5. Trust Boundaries Slide Supplement
6. Understanding Boundaries
7. Boundaries Technical Intro
8. Boundary Complexity
9. Exercises: Trust Boundaries Essay
10. Exercise: Draw Trust Boundaries
11. Models (answer key)
1. Tuesday Live Class Zoom Link
1. Sketching
2. DFDs in Depth
3. Boundaries in Depth
4. What Can Go Wrong? Brainstorming and Tools
5. STRIDE (Introduction)
6. Applying STRIDE
7. Tracking Threats + Assumptions
8. Exercise: STRIDE Essay
9. Exercise: Apply STRIDE
1. Wednesday Live Class Zoom Link
1. Tools in Context
2. Elevation of Privilege: The Game
3. Attack Trees
4. Final Tips + Recap: What Can Go Wrong
5. Mitigations
6. Strategies for Addressing Threats
7. Addressing Threats
8. Exercise: Design Control - Broadly
9. Exercise: Design Controls in Depth
10. Managing Risks
11. Exercise: Risk Management
12. (Optional) A Sense of Urgency
13. (Optional) Models of Change
14. (Optional) Managing "What We're Going to Do About it"
1. Did we do a good job?
2. Retrospectives
1. Thursday Live Class Zoom Link
1. Introduction to Kill Chains
2. Applying the Kill Chain
3. "Act On Objectives" Stage of the Kill Chain
4. MITRE'S ATT&CK Kill Chain
5. (optional) Kill Chain Cheat Sheet
6. Exercise: Kill Chain Essay
7. Exercise: Apply a Kill Chain
8. Exercise: End-to-End Threat Model
9. (Optional) Chess and Arms Races
10. (Optional) Prioritization
1. Friday Live Class Zoom Link
1. Sign up for our mailing lists.
1. Exercise: Final Homework
1. How did Shostack + Associates do?
2. Participate in a retrospective of Threat Modeling Intensive
1. Answer Key
2. Threat Modeling Lessons From Star Wars
3. Threat Modeling in 2020
4. The Threat Modeling Manifesto

About this course

Free
74 lessons
4.5 hours of video content

Reviews

"One of the top professional development courses in my 35+ year career. - Charles F."

Countdown timer

00 Days
00 Hours
00 Minutes
00 Seconds

Begin Course