Certified Threat Modeling Professional (CTMP)
Expert Hands-on Threat Modeling Training

The Certified Threat Modeling Professional (CTMP) is first of its kind Vendor-neutral threat modeling training and certification Program.

This course is targeted towards individuals or teams interested in devoting their careers to learning and implementing industry security best practices around Threat modeling.

Upon completion of this Threat Modeling training course, you will be able to understand:

Basics of Threat modeling from a business perspective.
Major components in Agile Threat Modeling
How to create and maintain Threat Modeling practice.
Creating and maintaining threat models.
Facilitating threat modeling sessions with a larger audience

Enroll Now

Top Rated Course

Check Out Reviews

Self-paced Learning Mode
Browser-based Lab Access
24/7 Instructor Support via Mattermost

CTMP Threat Modeling Training Course Prerequisites

Course participants should have knowledge of basic security fundamentals like Confidentiality, Integrity, and Availability (CIA)
Basic knowledge of application development is preferred but is not necessary

Chapter 1: Threat Modeling Overview

What is Threat Modeling?
The Threat Model Parlance
1. Security is a Balancing Act
2. Design Flaws and Risk Rating
Why Threat Model?
Threat Modeling vs. Other Security Practices
Threat Modeling Frameworks and Methodologies
1. List/Library Centric Threat Modeling
2. Asset/Goal Centric Threat Modeling
3. Threat Actor/Attacker Centric Threat Modeling
4. Software Centric Threat Modeling
Trust Boundaries vs. Attack Surfaces
Modern Threat Modeling Approaches for Agile and DevOps
Risk Management Strategies with Examples
1. Avoiding Risks
2. Accepting Risks
3. Mitigating Risks
4. Transferring Risks
Hands-on Exercises:
1. Breakout Sessions to Identify Threats for a Multi-Tiered Application

Chapter 2: Threat Modeling Basics

Threat Modeling and Security Requirements
Threat Modeling vs Threat Rating
Diagramming for Threat Modeling
List Centric Threat Modeling
Exploring the STRIDE Model
1. Spoofing
2. Tampering
3. Repudiation
4. Information Disclosure
5. Denial of Service
6. Elevation of Privileges
Pros and Cons of STRIDE
STRIDE defenses
1. Authentication
2. Integrity
3. Non-Repudiation
4. Confidentiality
5. Availability
6. Authorization
STRIDE Threat examples
Goal/Asset Based modeling Approach
1. Attack Trees
2. Attack Tree Analysis
Attacker/Threat Actor Centric Modeling Approach
1. Using MITRE ATT&CK for Attacker Centric Threat Modeling
Software Centric Threat Modeling
Other Threat modeling methodologies
1. PASTA
2. VAST
3. Hybrid Threat modeling
4. RTMP
5. OCTAVE
Gamified approaches for Threat Modelling
1. Virtual Card Games
2. Adversary Card Games
Introduction to Threat Rating
1. DREAD
2. OWASP Risk Rating Methodology
3. Bug Bar
4. Rapid Risk Assessment
Hands-on Exercises:
1. Creating a Data Flow Diagram for Threat Modeling
2. Using OWASP Cornucopia to Identity Web Related Threats
3. Creating Threat Actor Personas
4. Using Threat Actor Personas to Identify Threats
5. Risk Rating with OWASP Risk Rating Methodology

Chapter 3: Agile Threat Modeling

Agile Threat Modeling Approaches
1. Threat Modeling Diagrams as Code
2. Threat Modeling Inside The Code
3. Threat Modeling as Code
4. Compliance and Audit as Code
5. Rapid Threat Model Prototyping
Security Requirements as Code With BDD Security
Events of Agile Software Development Through Scrum
Writing Security Requirements for Agile Software Development
Writing Use Cases and Abuse Cases
Privacy Impact Assessments and Security Requirements
Identifying Privacy Related Threats
Hands-on Exercises:
1. Writing Abuse Cases for Password Reset Workflow
2. Threat Modeling Privacy for your system
3. Exploring UML as Code
4. Creating Attack Trees Using Code
5. Writing Threat Models Alongside Code
6. Writing Threat Models With Code
7. Writing Threat Models As Code
8. Writing Compliance As Code for PCI-DSS

Chapter 4: Reporting and Deliverables

How To Manage Threat Models
1. Documentation
2. Backlog
3. Bugs, and Tickets
4. Code
5. Automation
Threat Modeling Tools and Templates
1. Microsoft Threat Modeling Tool
2. OWASP Threat Dragon
3. CAIRIS Platform
4. Threat Modeling As Code Tools
5. Freemium Tools
6. Threat Model Templates and Examples
Validating Threat Models
1. Threat Model Versus Reality
2. All Threats Accounted For Risk
3. Mitigations Are Tested
4. Are We Done Threat Modeling?
Hands-on Exercises:
1. Threat Modeling with OWASP Threat Dragon
2. Threat Modeling Multi-Tiered Application with Irius Risk
3. Threat Modeling for Multi-Cloud with Irius Risk
4. Validating Threats with Automated Tests
5. Validating Mitigations with Automated Tests

Chapter 5: Secure Design Principles and Threat Modeling Native, and Cloud Native Applications

Exploring Principles of Secure Design with Examples
1. Principle of Economy of Mechanism
2. Principle of Fail Safe Defaults
3. Principle of Complete Mediation
4. Principle of Open Design
5. Principle of Separation of Privilege
6. Principle of Least Privilege
7. Principle of Least Common Mechanism
8. Principle of Psychological Acceptability
Case Study of AWS S3 Threat model
Case Study of Kubernetes Threat Model
Case Study of Very Secure FTP daemon

CTMP Course Certification Process

After completing the course, you can schedule the CTMP exam on your preferred date.
Process of achieving Practical DevSecOps CTMP Certification can be found here.

Agile Threat Modeling
in 5 simple steps

Get It Now

No email required

Ready to become a Security Champion?

Join our DevSecOps Professional course and gain hands-on experience with over 100 guided exercises in state-of-the-art online labs. Achieve a highly recognized DevSecOps Certification and advance your career.