Learning Threat Modeling for Security Professionals

Learning Threat Modeling for Security Professionals

English | MP4 | AVC 1280×720 | AAC 48KHz 2ch | 0h 41m | 298 MB

In the twenty-first century, no one doubts the importance of cybersecurity. Threat modeling is where it starts. Threat modeling is a framework for thinking about what can go wrong, and the foundation for everything a security professional does. This training course provides an overview of the traditional four-question framework for (1) defining what you’re working on, (2) discovering what can go wrong, (3) deciding what to do about it, and (4) ensuring you’ve done the right things in the right ways for the systems you’re delivering. Instructor Adam Shostack also reviews the STRIDE model for identifying six types of threats: spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege. Using a simple case study—a billing system for a media server that serves ads—Adam shows how to apply the principles and find security and privacy problems so the developer can include appropriate configurations and controls as part of the operational design and rollout.

Table of Contents

Introduction
1 Develop secure products
2 Why would you threat model
3 A simple approach to threat modeling

The Four Question Framework
4 What are we working on
5 What can go wrong
6 What are we going to do about it
7 Did we do a good job

STRIDE
8 Spoofing a specific server
9 Tampering with a file
10 Interlude – Scope and timing
11 Repudiating an order
12 Information disclosure
13 Denial of service
14 Elevation of privilege

Conclusion
15 Next steps