This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "OWASP NZ Training Day 2019-Threat Modelling From None to Done"
John dileo (talk | contribs) (Tag: Visual edit) |
John dileo (talk | contribs) (→Course Topics) (Tag: Visual edit) |
||
Line 24: | Line 24: | ||
The proposed outline for this course is as follows: | The proposed outline for this course is as follows: | ||
− | * | + | * Introductions, Logistics |
+ | * Overview and Initial Modelling Exercise | ||
* The Five Ws of Threat Modelling | * The Five Ws of Threat Modelling | ||
− | * Modelling | + | * Threat Modelling Approaches |
− | ** Case Study | + | ** The Four Questions |
− | * Threat Actor Personas | + | *** What Are You Building? - Identifying the Scope |
− | * | + | **** Case Study, Part 1 |
− | ** | + | *** What Could Go Wrong? |
− | ** | + | **** Identifying the Threats |
− | ** | + | **** Sidebar: Threat Actor Personas |
+ | **** Case Study, Part 2 | ||
+ | *** What Are We Going to Do about It? | ||
+ | **** Identifying Potential Mitigations | ||
+ | **** Deciding What to Do - Risk Management | ||
+ | **** Case Study, Part 3 | ||
+ | **** Prioritising Mitigations | ||
+ | *** Did we Do a Good Job? | ||
+ | **** Verification - Did we do the mitigations right? | ||
+ | **** Validation - Did we do the right mitigations? | ||
+ | * Threat Modelling Tools | ||
* Incremental Threat Modelling | * Incremental Threat Modelling | ||
− | * | + | * "Continuous" Threat Modelling |
− | |||
− | |||
== Course Details == | == Course Details == |
Latest revision as of 02:41, 11 November 2019
Threat Modelling: Getting from None to Done
Interactive Training -- OWASP New Zealand - Auckland Training Day 2019
This session offers participants an interactive introduction to Threat Modelling, based on the instructor's learning and experience over the past several years. A primary focus of this course is the introduction of threat modelling activities into your organisation's software development processes, to improve the overall quality and security of the applications we build.
As a recent "convert" to the application security world, your instructor is more or less a "journeyman" in the area of threat modelling, and has been gathering information from a variety of sources to come up with a practical approach to threat modelling in his organisation.
In addition to addressing key questions around the "Five Ws," the presentation will cover the "Four Questions" approach to developing a model, and include several interactive exercises to provide direct experience. Brief introductions to available modelling tools will also be included.
Learning Objectives
In this course, attendees can expect to:
- Gain a better understanding of the motivations for, and benefits of, threat modelling
- Learn the process for building a threat model, using the "four questions" approach
- Learn how to introduce threat modelling into existing organisations, and development projects working with "legacy" applications
- Learn the basics of using available tools to create and manage a threat model
- Learn about integrating threat modelling into the software development lifecycle
Course Topics
The proposed outline for this course is as follows:
- Introductions, Logistics
- Overview and Initial Modelling Exercise
- The Five Ws of Threat Modelling
- Threat Modelling Approaches
- The Four Questions
- What Are You Building? - Identifying the Scope
- Case Study, Part 1
- What Could Go Wrong?
- Identifying the Threats
- Sidebar: Threat Actor Personas
- Case Study, Part 2
- What Are We Going to Do about It?
- Identifying Potential Mitigations
- Deciding What to Do - Risk Management
- Case Study, Part 3
- Prioritising Mitigations
- Did we Do a Good Job?
- Verification - Did we do the mitigations right?
- Validation - Did we do the right mitigations?
- What Are You Building? - Identifying the Scope
- The Four Questions
- Threat Modelling Tools
- Incremental Threat Modelling
- "Continuous" Threat Modelling
Course Details
Date: Saturday, 11 August 2019
Time: 8:45 a.m. to 5:30 pm.
Course Fee: $125.00 (NZD)
Registration Site: https://owasp-training-day-2019.eventbrite.com
Location: Orion Health, 181 Grafton Road, Grafton, Auckland
Target Audience: Web Developers, Software Engineers, Application Security Professionals
Skill Level: Basic - All levels are welcome, no prior threat modelling or software development experience is assumed.
Required Materials: A laptop computer is not required for this class. If you wish, you can bring a laptop; power should be available, and WiFi access will be provided. For non-Windows computers, if you would like to install and use the Microsoft Threat Modeling Tool, a virtualisation tool (e.g., Virtual Box) and a Windows virtual machine will be needed.
Materials Provided: Each attendee will receive an online code to access Adam Shostack's book Threat Modeling: Designing for Security, a deck of Elevation of Privilege cards, and other printed resources
Instructor: Dr. John DiLeo
Instructor's Organisation: OWASP New Zealand Chapter
Supporting Materials
- Slide Deck (PDF, 4.1 MB)
- Presentation Slides: Adam Shostack - Threat Modeling in 2018 (PDF, adam.shostack.org)
- Presentation by Irene Michlin at AppSec EU 2017 - Incremental Threat Modeling Video (YouTube), Slide Deck (PDF)
- Presentation at AppSec EU 2009 - What Is Threat Modeling? (PPT)
- Presentation at AppSec EU 2009 - Advanced Threat Modeling (PPT)* Software Engineering Institute White Paper - Threat Modeling: A Summary of Available Methods (PDF)
- RSA 2017 Conference Learning Lab - Threat Modeling Demystified (PDF)
- SAFECode White Paper - Tactical Threat Modeling (PDF)
- STRIDE Reference Sheets (PDF, 112 kB), excerpted from Shostack text
- STRIDE Reference Cards (PDF, 5.0 MB), produced and branded by ThoughtWorks
- Microsoft Bug Bar Example (PDF)
- Microsoft's SDL Resource Site
- Download Page for Elevation of Privilege Card Decks
- OWASP Resource Sites:
- Threat Model Project Home Page
- Threat Modelling Category Page
- OWASP Threat Modeling Cheat Sheet (MarkDown, on GitHub)
Your Instructor
Dr. John DiLeo - John is the Auckland-area leader of the OWASP New Zealand Chapter, and is employed as the Application Security Architect at Orion Health, a global company specialising in health information software. In his current role, he is responsible for developing and managing the enterprise's software assurance progamme, with emphasis on governance, secure development practices, and security training. Before specialising in application security, John was active as a Java enterprise architect and Web application developer (mostly Java EE and LAMP). In an earlier life, John had specialised in developing discrete-event simulations of large distributed systems, in a variety of languages - including the Java-based language (FreeSML) he developed as part of his doctoral research. John is also a member of the core team for the OWASP Software Assurance Maturity Model (SAMM) Project, and of the OWASP Application Security Curriculum Project.