Threat Modeling

A curated list of threat modeling resources.

Start with Adam's book:

• https://www.amazon.com/Threat-Modeling-Designing-Adam-Shostack/dp/1118809998

Get the Elevation of Privilege (EoP) Threat Modeling Card Game from Microsoft (it's free!):

• https://www.microsoft.com/en-us/download/details.aspx?id=20303

Look at Microsoft's Threat Modeling home page:

• https://www.microsoft.com/en-us/securityengineering/sdl/threatmodeling

Review Nataliya Shevchenko's analysis of the 12 available methods:

• https://insights.sei.cmu.edu/sei_blog/2018/12/threat-modeling-12-available-methods.html

Check out the OWASP Threat Modeling category:

• https://www.owasp.org/index.php/Category:Threat_Modeling
• https://www.owasp.org/index.php/Application_Threat_Modeling

Review Wikipedia's Threat Model page:

• https://en.wikipedia.org/wiki/Threat_model