This workshop introduces you to some of the background of threat modeling and why to do it, as well as some of the tools and techniques for modeling systems, identifying threats, and selecting mitigations. The workshop guides you through the process of creating a system model and corresponding threat model. Then you assess the usefulness of these models. Each exercise has step-by-step instructions and you can use the associated participant workbook as you progress through the workshop. •Course level: Fundamental •Duration: 3 hours Activities: This course includes information presentations, interactive elements, and hands-on exercises. Course objectives: In this course, you will learn: •What threat modeling is and why it is useful •How to model a system using a data flow diagram •How to use a data flow diagram to find useful threats to a system •How to identify mitigations for threats and how to choose between them •How to evaluate the effectiveness of your models Intended audience: This course is intended for: •Software Developers •Product Managers •Systems Engineers •Architects Prerequisites: None Course outline: Module 1: Introduction •Workshop introduction •Workshop overview •Introduction to threat modeling Module 2: What are we working on? •What are we working on? •Exercise 1 Module 3: What can go wrong? •What can go wrong? •Exercise 2 Module 4: What are we going to do about it? •What are we going to do about it? •Exercise 3 Module 5: Did we do a good enough job? •Did we do a good enough job? •Exercise 4 Module 6: Conclusion •Resources •Feedback
