Threat Modeling

  1. Integrating Threat Modeling into the Development Lifecycle
    1. Threat Modeling in Different Methodologies
      1. Waterfall
        1. Threat Modeling in Design Phase
          1. Handoffs to Implementation
          2. Agile and Scrum
            1. Threat Modeling in Sprints
              1. Backlog Integration
              2. DevOps
                1. Continuous Threat Modeling
                  1. Automation Opportunities
                2. Timing the Threat Modeling Activities
                  1. During Design and Architecture Phase
                    1. Initial Threat Model Creation
                      1. Design Review Integration
                      2. During Sprint Planning
                        1. User Story Threat Analysis
                          1. Acceptance Criteria for Security
                          2. As a Continuous Activity
                            1. Ongoing Updates
                              1. Integration with Change Management
                            2. Roles and Responsibilities
                              1. Security Champions
                                1. Advocacy and Training
                                  1. Liaison Role
                                  2. Developers and Engineers
                                    1. Model Creation and Maintenance
                                      1. Implementing Mitigations
                                      2. Architects
                                        1. System Design Oversight
                                          1. Threat Model Review
                                          2. Security Professionals
                                            1. Facilitation and Guidance
                                              1. Risk Assessment
                                              2. Product Owners
                                                1. Prioritization of Security Work
                                                  1. Stakeholder Communication

                                              Previous

                                              6. Validation and Verification

                                              Go to top

                                              Next

                                              8. Domain-Specific Threat Modeling