Threat Modelling for Pragmatic Security Approaches

Threat Modelling for Pragmatic Security Approaches

Duration: half day

Wed 9th:

• $250: 10 spaces [ Buy Ticket ]
• Free: 10 spaces [ CLOSED ]

Abstract

Threat Modeling is the process of assessing a target application or infrastructure and then building a model that represents the perceived threats it may be facing. This model can prove invaluable for understanding, tracking, and improving security postures and also feed into preparing security activities and security strategies.

While there's been a couple of books and presentations on Threat Modeling, there is limited resources and guidance for applying the concepts in the real-world. It can be a daunting and overwhelming task trying to jump into a new Threat Model, so this training will spend a day sharing the theory, war-stories, and approaches from years of Threat Modeling work and will include hands-on exercises.

Target Audience

The training is designed to be accessible to a wide audience and works best with a broad range of attendees from different perspectives and backgrounds. Open discussion is encouraged throughout the day with a relaxed atmosphere where there's no wrong questions or ideas.

The training has components that can delve into quite technical and intricate subjects, however it's structured to at least promote the concepts and thought processes along the way.

The audience can be a mix of (but not limited to) the following backgrounds:

Security testers: individuals performing penetration testing, code reviews, red-teaming, etc.
Security consultants: individuals who perform risk assessments, products evaluation, incident response, security solution design.
Security managers: security operations managers, CISO's/CTO's looking at preparing pragmatic security roadmaps.
Software developers: individuals who work doing software architecture, software development, or QA testing.
Students/Enthusiasts: those keen to take a step back and look at security theories and concepts in a new light.
Agenda

Introduction

An introduction to Threat Modeling and a look at previous work.

Concepts

The basics, approaches, terminology, and current methodologies.

Theory

A brief run-through on the history of vulnerabilities and security incidents while examining common software architectures and how security practices are often applied in organisations. A key aspect of this theory is to see how security activities and technologies have evolved over the years and seeing their strengths and weaknesses while considering the big picture.

Exercises

Preparing a threat model based on a conversation only
Expanding a threat model based on reviewing a technical pentest report
Maturing a threat model by designing threats on other sources of information

Application

A session for how to grow and use a Threat Model over time

Wrap Up

Wrap-up discussion