Threat Assessment for Software Development

Takes approximately 3 hours to complete

Description

This course will give you the skills you need to carry out threat assessments throughout your software’s life.

From design and inception through to reviewing legacy systems, this repeatable and structured approach raises our focus from the lines of code we write to the ecosystems and processes we build.

You’ll learn how to understand your systems and their environment, assess your system using a threat assessment methodology, and prioritise your risks and apply defensive controls.

Certification

Security Architect: Level 1

Course Objectives

Capturing and understanding how a system is designed, including identifying any points where (a) data is collected, transmitted, processed, or stored, and/or (b) the system is connected to other dependent systems.
Using outcomes of the assessment to strategically prioritise security controls.
Learning to use attack trees to group and assess threats.
Learning to perform these assessments in your organisation.

Modules

Module 1: The Value of Threat Assessments

What value your organisation can get out of performing threat assessments and modelling
Who should be involved and when it should be performed
The challenges and benefits of threat assessing greenfield or new systems
The challenges and benefits of threat assessing existing or legacy systems

Module 2: Understanding Your System and Environment

How to apply systems thinking principles
How to visually capture the system being assessed, and areas of the system where data is accessed, stored, transferred, or shared
Understanding and developing security personas

Module 3: Applying a Threat Model

Introduction to Microsoft STRIDE
Applying STRIDE: Spoofing
Applying STRIDE: Tampering
Applying STRIDE: Repudiation
Applying STRIDE: Information disclosure
Applying STRIDE: Denial of service
Applying STRIDE: Escalation of privilege

Module 4: Using Attack Trees

Introduction to attack trees
How to build an attack tree
Challenges with attack trees

Module 5: Applying Prioritisation and Controls

The importance of prioritisation
Preventative, detective, and responsive/corrective controls
Applying defensive controls to software systems

Module 6: Performing Your Own Assessments

Getting the most out of your your threat assessment
Anti-patterns for threat assessment