Hands-On Security in DevOps

Summary

We discussed the importance of the whole team's involvement with threat modeling practices and the STRIDE examples (spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege).

There are several tools and methodologies to do threat modeling. If you would like to have a DFD/threat diagram designer, you can use the Microsoft threat modeling tool, OWASP Threat Dragon, or Mozilla SeaSponge. If you have a small team and would like to do threat modeling via a card game team activity, the Microsoft EOP card game and OWASP Cornucopia are recommended.

We also introduced some threat libraries such as CAPEC, ATT&CK, and CWE, which can also support threat identification during threat modeling. We also ...