Application Threat Modeling Implementation Tips and Tricks
summary
Provides concrete steps: map application services to information assets, draw DFDs that pull microservices and client‑side processes into the core, and produce an attack tree per feature. Recommends tools like OWASP Threat Dragon and Microsoft Threat Modeling Tool, warns automated tools miss logical flaws, and urges building an application‑specific threat library plus a traceability matrix. Claims ten practical tips, emphasizes implementable controls, logging for detection, and when to dig deeper.
AI-written summary · about
chapters (21)
- 0:00Introduction
- 1:15Selection of Methodology
- 2:15Application Threat Modeling Frameworks
- 4:22Application Threat Modeling Scope
- 7:14Asset Identification
- 9:10Application Architecture
- 13:26Communication
- 14:48Data Flow Diagram
- 16:33Web Application Data
- 16:50Client Side Code
- 21:17Connection Flow
- 22:31Logical Flow
- 22:55Dataflow Diagram
- 24:52Threat Identification
- 27:03Threat Libraries
- 27:45Continuous Threat Modeling
- 28:13Stride
- 29:15Tips
- 39:05Thread Traceability
- 40:34Understanding Threat Agents
- 42:22Risk Analysis
related talks
01h 00mThreat Modeling for Secure Software Design
57mUnlocking Threat Modeling
43mThreat modeling
53mThreat Modeling: uncover vulnerabilities without looking at code
22mEmpowering Developers through Threat Modeling Excellence
40mCloud Threat Modeling - from Architecture Design to Application Development
58mThreat Modeling In And For Your Organization
49mThreat Modeling Panel