Threat Modeling Security Fundamentals

  • Learning Path
  • 7 Modules
Beginner
Intermediate
Administrator
Developer
DevOps Engineer
Solution Architect
Security Engineer
Azure
Azure

This learning path takes you through the four main phases of threat modeling, explains the differences between each data-flow diagram element, walks you through the threat modeling framework, recommends different tools and gives you a step-by-step guide on creating proper data-flow diagrams.

Prerequisites

None

Modules in this learning path

Introduction to threat modeling

Threat modeling is an effective way to help secure your systems, applications, networks, and services. It's an engineering technique that identifies potential threats and offers recommendations to help reduce risk and meet security objectives earlier in the development lifecycle.

Create a threat model using data-flow diagram elements

Data-flow diagrams are graphical representations of your system and should specify each element, their interactions and helpful context.

Provide context with the right depth layer

Threat models can get complex if all parties involved can't agree on a data-flow diagram depth layer that provides enough context to satisfy requirements

Approach your data-flow diagram with the right threat model focus

Threat modeling is an effective technique to help you identify threats and ways to reduce or eliminate risk. We start by deciding to focus on either what needs to be protected or who it needs protection from.

Use a framework to identify threats and find ways to reduce or eliminate risk

Threat modeling helps you generate a list of potential threats using the threat modeling framework and find ways to reduce or eliminate risk with corresponding security controls.

Prioritize your issues and apply security controls

Threat modeling provides you with a list of threats and ways to reduce or eliminate risk, but it doesn't prioritize them for you. Also, there are no layered security control recommendations based on their type and function.