Continuous Threat Modeling: Practical, Agile Threat Modeling for Development Teams
We will examine how to use CTM, Continuous Threat Modeling, to implement threat modeling in an agile-compatible way for development teams. We will also look at OWASP pytm, a threat-modeling-with-code tool that helps automate some of the threat modeling work.
Requirements
Basic understanding of system development Basic knowledge of Object Oriented syntax (objects and their attributes). Python experience not required. A laptop A Python 3 environment, or the ability to run a virtual machine in VirtualBox format
This course will feature
An understanding of what Threat Modeling is, why it is beneficial and how it works in big strokes A detailed analysis of some publicly available threat models An overview of some of the currently in-use threat modeling methodologies, with practical exercises so the attendants can experience their pros and cons A discussion on the role of the developer in the threat modeling process A review of the Threat Modeling Manifesto and how it applies to bringing threat modeling practices to your organization An examination of the Continuous Threat Modeling methodology, followed by practical exercises A review of the existing Open Source threat modeling tools and their different usage scenarios A deep dive into pytm, the Pythonic library for threat modeling
Who this course is for
Developers, architects, testers and managers interested in Threat Modeling Security practitioners looking to sharpen their threat modeling skills
