Threat modelling for web applications
You draw a web app’s data flow diagram, find threats with STRIDE and attack trees, tie mitigations to verification tests and turn threat modelling into part of the team’s routine.
Level 301 · 15 lessons · 13 practice labs
Lessons
Foundations
- What threat modelling is: the four-question approach
- Data flow diagrams: processes, data stores and trust boundaries
- Assets, actors and attacker profiles
- Short task: draw the lab app’s data flow diagram
Finding threats
- Finding threats with STRIDE
- Attack trees and abuse cases
- Web-specific threats: sessions, APIs and third parties
- Privacy threats: a short look at LINDDUN
- Short task: write ten threats for a payment feature
Mitigations and process
- Rating and prioritising threats
- Mapping mitigations and tying them to verification tests
- Tools: OWASP Threat Dragon and threat models as code
- Threat modelling in an agile team: a short session for every new feature
- Running a threat-modelling session
- Capstone: threat-model a new file-sharing feature and verify its mitigations
Practice labs
- Trust boundaries on a data flow diagram: Draw the missing trust boundaries on a ready-made data flow diagram and label the data crossing each one.
- List the assets and actors: Put the assets to protect, the actors and the attacker profiles for the lab app into a table.
- Derive a diagram from code: Derive the real data flow from the lab app's code and configuration and find the differences from the documented diagram.
- A diagram of a flow with third parties: Draw the diagram of a flow that includes a payment provider and an email service and mark where data leaves the organisation.
- The login page through STRIDE: Write at least one threat per STRIDE letter for the login page and pick the two most likely.
- Write an abuse story: Write three abuse stories describing the attacker's goal against one user story.
- An attack tree: account takeover: Draw an attack tree for account takeover and show which branches the existing controls cut.
- Privacy threats: profile export: Work out the privacy threats for a profile export feature and propose data minimisation measures.
- Ten threats for a payment feature: Write ten threats for the payment feature of the fictional Kalvera Tickets, rate them and confirm the top three in the lab.
- Match threats to mitigations: Match ten threats to suitable mitigations and mark those without one as accept, transfer or fix.
- Tie a mitigation to a verification test: Write a runnable verification test in the lab for three mitigations and reveal that one was never implemented.
- A threat model as code: Keep a threat model as text in the repo, update it when a new endpoint is added and tie the change to the review process.
- The threat model of a file sharing feature: Produce the diagram, threats and mitigations for a new file sharing feature and verify the two most critical mitigations in the lab.
About this course
You draw a web app’s data flow diagram, find threats with STRIDE and attack trees, tie mitigations to verification tests and turn threat modelling into part of the team’s routine.
What you will learn
- Foundations
- Finding threats
- Mitigations and process
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.