Course

Why Do Threat Modeling?

This course provides background and introduction to the basic concepts of why threat modeling is a powerful security capability.

    Syllabus

  • Defense-In-Depth in the Past Video — 00:07:24
    • Explore a historical example of defense-in-depth.

  • Threat Model Activity Output Video — 00:04:11
    • Explore scoping, architectural appSec activities with the threat modeling activity and results.

  • Defense-In-Depth in the Present Video — 00:08:22
    • In this video, you’ll take a look at the modern use of defense-in-depth for IT systems, adding the Open Systems Interconnection model for reference.

  • The TL;DR of Why We Need to Threat Model Video — 00:09:17
    • This explains the Attack Kill-Chain and how to use it as a tool for rough threat modeling.

  • Welcome to Threat Modeling! Video — 00:01:05
  • Threat Model Activity Recommends Video — 00:10:55
    • In this video, you’ll look at development and testing of risk appSec activities with the threat modeling activity and results.

  • Software Delivery Activity Integration Video — 00:11:14
    • What is the best time to do threat modeling?

Syllabus

Course description

This course gives the viewer a background of why we need to carry out security architectural and design analysis and threat modeling as part of our secure software development life cycle. This is even more important today, with rapid code turnarounds which can create a huge amount of dependencies in a short period of time.

Meet the author

Geoffrey Hill has been in the IT industry since 1990 when he wrote and sold C++ based solutions to measure risk in the commodities markets in New York City. Since then he has worked around the world, specifically in New York, Sydney, Tokyo, Emmerich-am-Rhein and London.

In the mid-2000s, He was the main custodian of the Microsoft Security Development Lifecycle (SDL) initiative in the UK and then international services organization as part of the Microsoft Security Center of Excellence (SCOE). From 2013 to 2018, he worked as the sole application security architect for Visa Europe in London, where he started Tutamantic Ltd, a producer of software risk automation.

Geoff is the inventor of the Rapid Threat Model Prototyping (RTMP) methodology. This threat model methodology allows for quick modeling in Agile and DevOps environments.

You're in good company

CY

We use Infosec Skills to provide continuous training to our technicians and to prepare them for various certifications. Infosec Skills allows us to create personalized training programs that focus on each of our technicians’ particular roles and see their progress as they take courses. We also, recommend it to clients to make their IT support teams better.

Caleb Yankus

DS

This has been utilized to bridge the skills gap across our cyber team and to aid them as they prepare for their various certifications. It also has provided a nice learning foundation for our various cyber team members to utilize as we continue to find ways for cross-utilization with operations while minimizing the downtime needed to ensure everyone’s knowledge is the same.

Daniel Simpson

IS

We use Infosec Skills to provide base level knowledge for employees. We also use the services to provide in depth learning for employees as they encounter new technologies. If an employee is is assigned to a new project, we can rely on Infosec Skills to provide a rapid concentrated learning environment. This rapid concentrated learning positions our employees for success.

Infosec Skills Teams client

Plans & pricing

  • Infosec Skills Personal

    $299 / year

    • 190+ role-guided learning paths (e.g., Ethical Hacking, Threat Hunting)
    • 100s of hands-on labs in cloud-hosted cyber ranges
    • Custom certification practice exams (e.g., CISSP, Security+)
    • Skill assessments
    • Infosec peer community support
  • Infosec Skills Teams

    $799 per license / year

    • Team administration and reporting
    • Dedicated client success manager
    • Single sign-on (SSO)
      Easily authenticate and manage your learners by connecting to any identity provider that supports the SAML 2.0 standard.
    • Integrations via API
      Retrieve training performance and engagement metrics and integrate learner data into your existing LMS or HRS.
    • 190+ role-guided learning paths and assessments (e.g., Incident Response)
    • 100s of hands-on labs in cloud-hosted cyber ranges
    • Create and assign custom learning paths
    • Custom certification practice exams (e.g., CISSP, CISA)
    • Optional upgrade: Guarantee team certification with live boot camps

Unlock 7 days of free training

  • 1,400+ hands-on courses and labs
  • Certification practice exams
  • Skill assessments

Award-winning training that you can trust

Comprehensive Cybersecurity Training - Infosec Skills
Cybersecurity Education and Training Gold Award - Infosec IQ
Top Rated Award - Infosec Skills
2021 G2 Summer - Leader - Tech Skills Dev, Online Course, eLearning Content
Top 20 Company - Online Learning Library