Threat modeling is a foundational framework for security professionals. In this learning path, learn how to use the STRIDE model to identify key threats—spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege—and deliver secure products and services.
-
Learn why threat modeling is foundational to the SDL.
-
Identify six common threats and discover how they work.
-
Develop your threat modeling skills.
Courses
-
1
Learning Threat Modeling for Security Professionals41mLearning Threat Modeling for Security Professionals
By: Adam Shostack
Threat modeling helps security professionals understand what can go wrong—and what to do about it. Learn to use the four-question and STRIDE frameworks for threat modeling.
-
2
Threat Modeling: Spoofing In Depth55mThreat Modeling: Spoofing In Depth
By: Adam Shostack
Learn about one of the key threats to modern systems: spoofing, or authentication attacks. Explore ways that attackers spoof people, machines, file systems, and processes.
-
3
Threat Modeling: Tampering in Depth32mThreat Modeling: Tampering in Depth
By: Adam Shostack
Learn how tampering threats work and how to mitigate them. Explore how attackers can tamper with a variety of systems and tools, from debuggers to cloud services.
-
4
Threat Modeling: Repudiation in Depth25mThreat Modeling: Repudiation in Depth
By: Adam Shostack
Explore repudiation threats and how to defend against them. Learn how to grapple with fraud, identity theft, and repudiation in specific technologies such as blockchain.
-
5
Threat Modeling: Information Disclosure in Depth29mThreat Modeling: Information Disclosure in Depth
By: Adam Shostack
Learn about the information disclosure pillar in the STRIDE threat modeling framework. Discover how to preserve the confidentiality of the data, secrets, and other information you store.
-
6
Threat Modeling: Denial of Service and Elevation of Privilege46mThreat Modeling: Denial of Service and Elevation of Privilege
By: Adam Shostack
This final installment of the Threat Modeling series covering the STRIDE framework explains denial-of-service and elevation-of-privilege attacks.