Advanced threat modelling: attack trees and models as code
You model large systems with attack trees, risk scoring and threat models kept as code, and set up a process that keeps the model current with every change.
Level 301 · 17 lessons · 15 practice labs
Lessons
Attack trees
- Attack trees: root goal, sub-paths, AND/OR nodes
- Adding cost and likelihood to nodes
- Feeding the tree with CAPEC and ATT&CK
- Short task: draw an attack tree for the goal “steal customer data”
Risk scoring
- Likelihood and impact: a simple risk matrix
- DREAD and its alternatives: why consistency matters
- The OWASP risk rating method
- Privacy threats with LINDDUN
- Short task: score and rank ten threats with one method
Threat models as code
- Keeping the threat model as code: why and how
- Describing a system in Python with pytm
- Generating diagrams and reports from the model
- Updating the model when the design changes: the pull request flow
- Short task: add a new payment service to an existing model
Scaling up
- Modelling multi-service systems piece by piece
- Running a team workshop
- Capstone: a threat model as code and risk register for a payment platform
Practice labs
- Read the AND and OR nodes in an attack tree: Count the paths to the root goal in a ready tree and state which nodes are required together.
- Draw an attack tree to protect customer data: For the root goal of customer data being stolen, draw at least three sub-paths with second-level nodes.
- Add cost and likelihood to the tree and close the cheapest path: Enrich nodes with CAPEC and ATT&CK entries, give every leaf a cost and likelihood, find the cheapest path and propose the control that cuts it.
- Place threats on a likelihood and impact matrix: Put eight threats on a five-by-five matrix and name those in the red zone.
- Score and rank ten threats with one method: Calculate each threat’s score using the OWASP risk rating factors and justify the ranking.
- Reconcile the different rankings of two scoring methods: Score the same threats with DREAD and the OWASP method, explain where the order changes and write a consistent rule for the team.
- Match privacy threats to LINDDUN categories: Place seven sample situations under linkability, identifiability, non-repudiation, detectability, disclosure, unawareness and non-compliance.
- Find the privacy threats in a health app’s data flow: Write one LINDDUN threat at every point personal data passes in Lavinya Klinikleri’s appointment flow.
- Design data minimisation measures against privacy threats: For the five gravest privacy threats choose measures such as pseudonymisation, retention limits and access logging, and state the residual risk.
- Run a model written in pytm and read the output: Generate the diagram and threat report from a ready model file and state how many findings come out.
- Add a new payment service to an existing model: Define the service, its data store and flows in the pytm model, place it in a trust boundary and list the new threats that appear.
- Carry a design change into the model through the pull request flow: Set up a CI step that regenerates the report when the model changes and requires review when a new high threat appears.
- Split a multi-service system into pieces to model: Divide a ten-service architecture into four pieces along trust boundaries and list the flows between them.
- Prepare the agenda and output of a team workshop: Write the participants, steps and threat record template for a ninety-minute workshop.
- Produce a threat model as code and risk register for a payment platform: Write the three-part model in pytm, score the threats and produce a risk register with owner, control and date.
About this course
You model large systems with attack trees, risk scoring and threat models kept as code, and set up a process that keeps the model current with every change.
What you will learn
- Attack trees
- Risk scoring
- Threat models as code
- Scaling up
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.