Chapter 1 of 6 · 4 practices · 5 min · 3-question quiz
The four questions and the right mindset
What threat modeling is for, when to do it, and who should be in the room. The four questions give every session the same simple shape.
Start: Structure every session around the four questions4 practices in this chapter
- 1Structure every session around the four questionsThe Threat Modeling Manifesto and the OWASP Threat Modeling Cheat Sheet both organize the work around four questions: The questions keep a session from drifting. A meeting that spends an hour…
- 2Threat model during design, then again as the design changesThe Manifesto's first principle is that the best use of threat modeling is to improve the security and privacy of a system through early and frequent analysis. The OWASP cheat sheet says the same: do…
- 3Make it a team activity, not a job for one security heroThe Manifesto lists the Hero Threat Modeler as an anti-pattern: threat modeling does not depend on innate ability or a unique mindset, and everyone can and should do it. Its values favor people and…
- 4Aim for useful, not perfect: avoid the common anti-patternsThe Manifesto's anti-patterns describe the ways teams stall: Its values point the same way: a culture of finding and fixing design issues over checkbox compliance, doing threat modeling over talking…
Check yourself on this chapter
3 questions, right here once you are signed in. Your progress is saved as you read.