Threat modeling is the primary security analysis task performed during the software design stage. Threat modeling is a structured activity for identifying and evaluating application threats and vulnerabilities. The security objectives, threats, and attacks modeling activities during the threat modeling are designed to help you find vulnerabilities in your application and the supporting architecture. You can use the identified vulnerabilities to help shape your design and direct and scope your security testing.

Threat modeling allows you to consider, document, and discuss the security implications of designs in the context of their planned operational environment and in a structured fashion. It also allows consideration of security issues at the component or application level. The threat modeling course will teach you to perform threat modeling through a series of workshops, where our trainer will guide you through the different stages of a practical threat model.

Prerequisites

None.

Target Audience

This course is aimed at software developers, architects, system managers or security professionals. Before attending this course, students should be familiar with basic knowledge of web and mobile Applications, databases & Single sign on (SSO) principles.

We can organize this training at your preferred date and location.

What You Will Learn

The why, what, how, and when of threat modelling
How to create and update a threat model
How to create an actionable threat model with your stakeholders
How to organise and prepare efficient threat modelling workshops
How to explain the methodology and need for threat modelling to others
Diagramming techniques, including Data Flow Diagramming
Threat identification techniques, including STRIDE and attack trees
How to carry out technical risk rating using the OWASP risk rating methodology
How to mitigate security and privacy threats with standard mitigations
The soft skills that will make you a better threat modeler

Training Outline

Threat modeling introduction

Threat modeling in a secure development lifecycle
What is threat modeling?
Why perform threat modeling?
Threat modeling stages
Different threat modeling methodologies
Document a threat model

Diagrams – what are you building?

Understanding context
Doomsday scenarios
Data flow diagrams
Trust boundaries
Sequence and state diagrams
Advanced diagrams
Hands-on: diagramming web and mobile applications, sharing the same REST backend

Identifying threats – what can go wrong?

STRIDE introduction
Spoofing threats
Tampering threats
Repudiation threats
Information disclosure threats
Denial of service threats
Elevation of privilege threats
Attack trees
Attack libraries
Hands-on: STRIDE analysis of an Internet of Things (IoT) gateway and cloud update service

Addressing each threat

Mitigation patterns
Authentication: mitigating spoofing
Integrity: mitigating tampering
Non-repudiation: mitigating repudiation
Confidentiality: mitigating information disclosure
Availability: mitigating denial of service
Authorization: mitigating elevation of privilege
Specialist mitigations
Hands-on: AWS threat mitigations for a travel booking system build on microservices

Threat modeling and compliance

How to marry threat modeling with compliance
GDPR and Privacy by design
Privacy threats
LINDUNN and Mitigating privacy threats
Threat modeling medical devices (FDA pre- and post-market guidance)
Threat modeling Industrial Control Systems (IEC 62443)
Threat Assessment and Remediation Analysis for automotive (TARA, SAE 21434)
Mapping threat modeling on compliance frameworks
Hands-on: privacy threat modeling of a face recognition system in an airport

Penetration testing based on offensive threat models

Create pentest cases for threat mitigation features
Pentest planning to exploit security design flaws
Vulnerabilities as input to plan and scope security testing
Prioritization of pentesting based on risk rating
Hands-on: get into the defender's head – modeling points of attack of a nuclear facility.

Advanced threat modeling

Typical steps and variations
Validation threat models
Effective threat model workshops
Communicating threat models
Agile and DevOps threat modeling
Improving your practice with the Threat Modeling Playbook
Scaling up threat modeling
Threat modeling and compliance: ISO14971 (medical devices), IEC 62443 (industrial cybersecurity), SAE 21434 (automotive)
Threat models examples: medical devices, automotive, industrial control systems, IoT and Cloud

Threat modeling resources

Open-Source tools
Commercial tools
General tools
Threat modeling tools compared
Battle for control over 'Zwarte Wind', an offshore wind turbine park

Examination

Hands-on examination
Grading and certification

Student package

Your bonus training package includes:

Following a successful exam (passing grade defined at 70%): Threat Modeling Practitioner certificate
One year of access to our threat modeling e-learning platform
Presentation handouts
Tailored use case worksheets
Detailed use case solution descriptions
Threat model documentation template
Template for calculating identified threat risk severity
Threat modeling playbook
STRIDE mapped on compliance standards

Why Choose Us

Experience Whiteboard Hacking (AKA Hands-On Threat Modelling) through Bilginç IT Academy's live and interactive virtual classroom environment. Join a Public course as an individual delegate or arrange a dedicated Private / In-house online training program exclusively for your organization.

Delivery Method: Online Instructor-Led
Participation Model: Public / Private (In-house)
Live and Interactive Training: Connect with your instructor in real time and actively participate through discussions, Q&A sessions, practical exercises, and group activities.
Flexible Participation: Join the training from your home, office, or any location with a suitable internet connection.
Expert Trainer Network: Learn from experienced trainers with strong industry backgrounds and practical field expertise.
Over 30 Years of Training Expertise: Benefit from Bilginç IT Academy's professional training experience since 1995.
Worldwide Access: Join our live virtual classrooms from anywhere in the world or arrange a dedicated online training program for your organization.

Experience Whiteboard Hacking (AKA Hands-On Threat Modelling) in a professional face-to-face classroom environment. Classroom Based training can be delivered as a Public course open to individual delegates or as a dedicated Private / In-house class exclusively for your organization.

Delivery Method: Classroom Based
Participation Model: Public / Private (In-house)
Face-to-Face Learning: Interact directly with your instructor and fellow delegates in an engaging classroom environment.
Experienced Trainers: Learn from specialists with extensive industry experience and practical real-world knowledge.
Professional Training Environment: Attend training in comfortable, well-equipped classrooms designed to support effective learning.
Practical Learning: Depending on the course, reinforce your knowledge through hands-on exercises, scenarios, case studies, and instructor-led activities.

Arrange Whiteboard Hacking (AKA Hands-On Threat Modelling) as a dedicated Onsite training program for your organization. Bilginç IT Academy trainers can deliver the training at your office or another location of your choice, with the program planned around your team's requirements and business objectives.

Delivery Method: Onsite
Participation Model: Private (In-house)
Training at Your Preferred Location: Organize the training at your company's office or another location selected by your organization.
Tailored Course Content: Adapt the training program to your projects, team structure, existing skill levels, and specific business requirements.
Team-Focused Learning: Develop your team around a shared knowledge base while strengthening internal collaboration and knowledge transfer.
Flexible Scheduling: Plan the training dates, location, and program according to your organization's operational requirements.
Worldwide Onsite Delivery: Bilginç IT Academy trainers can travel internationally to deliver dedicated training programs at your preferred location.

Why have you chosen us?

I have attended a training from Bilginc IT Academy before and I was satisfied.

I have attended a training from a different provider and it was not helpful.

Other

How many employees do you have in your IT department?

0 – 50

50 – 250

250 – 1000

1000+

Whiteboard Hacking (AKA Hands-On Threat Modelling) Training

Prerequisites

Target Audience

What You Will Learn

Training Outline

Why Choose Us