search

hysnsec / awesome-threat-modelling

A curated list of threat modeling resources (Books, courses - free and paid, videos, tools, tutorials and workshops to practice on ) for learning Threat modeling and initial phases of security review.
https://www.practical-devsecops.com/devsecops-university/
Creative Commons Zero v1.0 Universal
1.35k stars 245 forks source link

Add Free Threat Modeling Course #17

Closed geoffrey-hill-tutamantic closed 3 years ago

geoffrey-hill-tutamantic commented 3 years ago

Rapid Threat Model Prototyping (RTMP)... found here: https://github.com/geoffrey-hill-tutamantic/rapid-threat-model-prototyping-docs

RTMP is a threat modelling technique that decreases the time to make a threat model by focusing on getting the Access Control issues sorted first (Elevation of privilege in STRIDE). It uses STRIDE as its main description language but allows for integration with CWE and OWASP Top 10.

RTMP allows a practioner to add metadata describing the threats and mitigations directly to software diagrams, speeding up the whole threat modeling process. This is done through 11 simple steps which can be repeated across all sizes of projects.

RTMP also outlines how to properly integrate these steps into Agile workstreams and how to best use the outputs of a threat model (Threats & Mitigations).

geoffrey-hill-tutamantic commented 3 years ago

I've added this as a Pull Request.