Threat modelling: STRIDE and data flow diagrams
You draw a system through an attacker’s eyes before any code is written, find threats with STRIDE and prioritise practical countermeasures for each.
Level 201 · 18 lessons · 15 practice labs
Lessons
Foundations
- What threat modelling is and when to do it
- Four questions: what are we building, what can go wrong, what will we do, did we do a good job
- Assets, attackers and entry points
- Short task: list the assets and attackers of an online shop
Data flow diagrams
- Diagram elements: process, data store, external entity, flow
- Drawing trust boundaries
- Drawing the diagram with a tool: OWASP Threat Dragon
- Level of detail: from context diagram to sub-processes
- Short task: draw the diagram of a password reset feature
STRIDE
- Spoofing and tampering
- Repudiation and information disclosure
- Denial of service and elevation of privilege
- STRIDE per element: which threat fits where
- Short task: fill a STRIDE table for every flow in your diagram
Countermeasures and follow-up
- Choosing a response: eliminate, mitigate, transfer, accept
- Rating threats simply
- Turning threats into tickets and tracking them
- Capstone: threat-model a mobile banking API
Practice labs
- List the assets and attackers of an online shop: Write five assets worth protecting and three kinds of attacker who might want them.
- Identify the system’s entry points: Find every point where Turnalı Perakende’s order system takes outside data and show which asset each leads to.
- Apply the four questions to a small feature end to end: For a gift voucher feature answer on one page what we are building, what can go wrong, what we will do and whether we did well enough.
- Label the diagram elements with the right type: Mark the processes, data stores, external entities and flows in a given drawing.
- Draw the data flow diagram of a password reset feature: Draw the flows between user, application, mail service and database and add the trust boundaries.
- Break a context diagram into sub-processes and save it in Threat Dragon: Split a one-box payment system into three sub-processes, mark every trust boundary crossing and store the model as a file in the tool.
- Place sample threats into STRIDE categories: Sort twelve threat statements under spoofing, tampering, repudiation, information disclosure, denial of service and elevation of privilege.
- Fill a STRIDE table for every flow in your diagram: Write the applicable threat categories and a concrete example for every element of the password reset diagram.
- Find the overlooked threat with STRIDE per element: Check a ready threat list against the element-type-to-threat mapping and add the three missing threats with reasons.
- Choose a response type for each threat: Mark eight threats as eliminate, mitigate, transfer or accept.
- Rate and rank threats on a simple scale: Give ten threats a likelihood and impact score, produce the ranking and write the countermeasure for the top three.
- Turn threats into tickets and make them traceable: Write a ticket with acceptance criteria for each countermeasure, show the threat-to-ticket link in a table and state how it is verified.
- Identify the assets and trust boundaries of a mobile banking API: Extract five assets and three trust boundaries from the given architecture note.
- Produce the threat list for the money transfer flow: Write at least one STRIDE threat for every element a transfer request passes through.
- Complete the threat model of a mobile banking API: For Yelkovan Bankası’s API gather the diagram, threat table, scoring and countermeasures in one document and summarise the three riskiest threats for management.
About this course
You draw a system through an attacker’s eyes before any code is written, find threats with STRIDE and prioritise practical countermeasures for each.
What you will learn
- Foundations
- Data flow diagrams
- STRIDE
- Countermeasures and follow-up
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.