Threat modeling is the primary security analysis task performed during the software design stage. Threat modeling is a structured activity for identifying and evaluating application threats and vulnerabilities. The security objectives, threats, and attacks modeling activities during the threat modeling are designed to help you find vulnerabilities in your application and the supporting architecture. You can use the identified vulnerabilities to help shape your design and direct and scope your security testing. For this training, we will teach an iterative and incremental threat modeling method that is integrated in the development and deployment pipeline.
Threat modeling allows you to consider, identify, and discuss the security implications of user stories in the context of their planned operational environment and in a structured fashion. It also allows consideration of security issues at the component or application level. In this bootcamp you will learn how to perform threat modeling through a series of workshops, where our trainer will guide you through the different stages of a practical threat model based on an AWS and microservices migration from a classical web application.
Target group: DevOps Engineers
Participant requirements: Participants should be familiar with basic knowledge of microservices, cloud architectures and AWS.
Threat modeling introduction
Diagrams – what are you building?
Identifying threats – what can go wrong?
Addressing each threat
Practical threat modeling as part of the DevOps pipeline
Threat modeling resources
As highly skilled professionals with years of experience under our belts we know that there is a gap between academic knowledge of threat modeling and the real world.
In order to minimize that gap we have developed practical Use Cases, based on real life projects. Each use case includes a description of the environment, together with questions and templates to build and iteratively improve a threat model. Using this methodology for the hands-on workshops we provide the participants with a robust training experience and the templates to incorporate threat modeling best practices in their daily DevOps work.
The participants will be challenged to perform practical threat modeling in squads of 3 to 4 people covering the different stages of threat modeling on an incremental business driven CI/CD scenario:
After each hands-on workshop, the results are discussed, and the students receive a documented solution.
Participant package: The course students receive the following package as part of the course:
Hardware requirements: Participants should bring their own laptop or tablet to read and use the training handouts and exercise descriptions. No further requirements.
Maximum number of participants: 25