# TMP - Threat Modelling Professional

This is a full 8 hours hands-on course where you will learn the practical fundamentals of threat modelling and how to apply it as part of the SSDLC. Learn how to use STRIDE, MITRE ATT\&CK, and  OWASP standards to identify threats in your applications. 

![](/files/750PXA8K9gHavz0Gz8Vm)

## Prerequisites

* Interest in security

## Target audience

* Security Engineers 
* Security Champions
* DevOps 
* Developers 
* Cloud Engineers / Operations
* Product Owners

## Abstract

Threat modeling is one of the most important activities in secure software development. This course is designed to give students a practical understanding of Threat Modeling, through whiteboard exercises, real case scenarios, tools, and techniques available in the security industry. The course is project-oriented. Students will go over hands-on labs together with the trainer and solve some of the challenges presented. During the course, other concepts like Secure Coding Principles, Security Requirements, Agile Threat Modelling, Threat Modelling as Code, and Cloud Security will be introduced. This is to ensure that students have a complete overview of the differences and the output of each phase.

## Syllabus

<table><thead><tr><th>Module</th><th width="387.3333333333333">Topic</th><th>Time</th></tr></thead><tbody><tr><td><strong>Secure Software Development Lifecycle</strong></td><td></td><td></td></tr><tr><td></td><td>From SDLC to SSDLC (shift left)</td><td></td></tr><tr><td></td><td>OWASP Top 10 2021 introduction</td><td></td></tr><tr><td></td><td>Design Review, Threat Model and secure CI/CD pipeline introduction</td><td></td></tr><tr><td></td><td>DevOps to DevSecOps: how to</td><td></td></tr><tr><td><strong>Secure design</strong> </td><td></td><td></td></tr><tr><td></td><td>Secure Design principles</td><td></td></tr><tr><td></td><td>OWASP ASVS V4</td><td></td></tr><tr><td></td><td>From user cases to abuse cases</td><td></td></tr><tr><td></td><td>From abuse cases to security requirements</td><td></td></tr><tr><td></td><td><strong>LAB:</strong> OWASP SKF introduction</td><td></td></tr><tr><td><strong>Practical Threat Modelling</strong></td><td></td><td></td></tr><tr><td></td><td>The STRIDE framework: what is it and how to use it</td><td></td></tr><tr><td></td><td>Threat rating methodologies   (CVSS , DREAD)</td><td></td></tr><tr><td></td><td>Threat actor centric modeling Approach (MITRE ATT&#x26;CK)</td><td></td></tr><tr><td><strong>LAB:</strong> Whiteboard exercise </td><td></td><td></td></tr><tr><td></td><td></td><td></td></tr><tr><td></td><td>Web application threat model </td><td></td></tr><tr><td><strong>Cloud Threat Modelling</strong></td><td></td><td></td></tr><tr><td></td><td>Differences between Cloud and Web Threat Modelling</td><td></td></tr><tr><td></td><td>The Egregious Eleven (CSA)</td><td></td></tr><tr><td></td><td>Tesla in depth practical example</td><td></td></tr><tr><td></td><td>Cloud Security Requirements</td><td></td></tr><tr><td></td><td>CSA Cloud Control Matrix: How to use it</td><td></td></tr><tr><td></td><td>STRIDE and the Egregious Eleven for Cloud environments</td><td></td></tr><tr><td></td><td>AWS Threat Modelling</td><td></td></tr><tr><td><strong>LAB:</strong> Whiteboard exercise</td><td></td><td></td></tr><tr><td></td><td>Cloud Security Threat Modelling </td><td></td></tr><tr><td></td><td></td><td></td></tr><tr><td><strong>Mobile Threat Model</strong> </td><td></td><td></td></tr><tr><td></td><td>OWASP MASVS</td><td></td></tr><tr><td></td><td>Top Threats in Mobile applications: OWASP Top 10 </td><td></td></tr><tr><td></td><td>STRIDE for Mobile applications</td><td></td></tr><tr><td><strong>LAB:</strong> Whiteboard exercise</td><td></td><td></td></tr><tr><td></td><td>Android Application Threat Model </td><td></td></tr><tr><td><strong>Agile Threat Model</strong></td><td></td><td></td></tr><tr><td></td><td>Threat Model for DevSecOps</td><td></td></tr><tr><td></td><td>Rapid and Continuous Threat Modelling Assessment: microservices</td><td></td></tr><tr><td><strong>LAB:</strong> Hands-on</td><td>Threat Model as Code</td><td></td></tr><tr><td></td><td><p>Automate your remediation tests: BDD testing</p><p><br></p></td><td></td></tr><tr><td><strong>LAB:</strong> Hands-on</td><td>Build your first BBD test in Cucumber </td><td></td></tr><tr><td></td><td>Tools and technologies</td><td></td></tr><tr><td><strong>Documentation</strong></td><td></td><td></td></tr><tr><td></td><td>How to store threats, issues and remediations</td><td></td></tr><tr><td></td><td>Confluence and JIRA</td><td></td></tr></tbody></table>

## Why should you attend this course?&#x20;

This course will teach how to start securing application and cloud infrastructure as early as possible, giving you the knowledge and the tools required to perform Threat Model exercises with your team.&#x20;

{% hint style="info" %}

### More info? Contact us at <trainings@dcodx.com>

{% endhint %}


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://1337.dcodx.com/trainings/tmp-threat-modelling-professional.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.