Hands-On Security in DevOps

Threat assessment

To have an effective threat assessment, the following guideline or templates are suggested for the project team:

Threat Modeling tools/templates	Rationale and purpose
Knowledge-base of threats and mitigation	Threat and mitigation knowledge can help the team to decide what's most relevant to the project from the knowledge list instead of starting from zero. For example, CAPEC or ATT&CCK are also good references.
Tools or threat modeling templates	A template or tool can enable the team to deliver consistent quality for threat modeling reports.

In addition, threat modeling analysis won't limit itself to the role of the development team. It also involves the whole team including RD, QA, and DevOps.