Thinking like an Attacker: Introduction to Threat Modeling
summary
Walks through building an L0 then an L1 data-flow diagram for a fictional game showing where users, front-end, backend and databases connect, adds STRIDE to map spoofing/tampering/repudiation/DoS/elevation to each flow, and runs small threat trees (cheating via replay, man‑in‑the‑middle tamper, credential leakage from weak storage). Uses Microsoft Threat Modeling Tool and mentions Threat Dragon, recommends TLS, fuzzing, key rotation and Android keystore mitigations.
AI-written summary · about
chapters (9)
- 0:00Introduction to threat modeling
- 1:08Secure development lifecycle basics
- 4:15Building a threat model diagram
- 8:07Understanding STRIDE framework
- 13:21Creating your own threat model
- 16:20Threat trees and vulnerabilities
- 22:21Severity triage and risk assessment
- 24:32Tools and resources summary
- 25:14Q&A on API keys and security
related talks
01h 00mThreat Modeling for Secure Software Design
43mThreat modeling
57mUnlocking Threat Modeling
53mThreat Modeling: uncover vulnerabilities without looking at code
51mApplication Threat Modeling Implementation Tips and Tricks
40mCloud Threat Modeling - from Architecture Design to Application Development
58mThreat Modeling In And For Your Organization
49mThreat Modeling Panel