Skip to content

A curated list of threat modeling resources (Books, courses - free and paid, videos, tools, tutorials and workshops to practice on ) for learning Threat modeling and initial phases of security review.

License

Notifications You must be signed in to change notification settings

miiiak/awesome-threat-modelling

 
 

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

89 Commits
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

Awesome Threat Modeling Awesome

A curated list of threat modeling resources (books, courses - free and paid, videos, tools, tutorials and workshop to practice on) for learning Threat modeling and initial phases of security review.

Contributions welcome. Add links through pull requests or create an issue to start a discussion.

Contents

Fundamentals

Books

Books on threat modeling.

Courses

Courses/Training videos on threat modeling.

Free

Paid

Videos

Videos talking about Threat modeling.

Tutorials and Blogs

Tutorials and blogs that explain threat modeling

Threat Model examples

Threat model examples for reference.

Tools

Tools which helps in threat modelling.

Free tools

  • OWASP Threat Dragon - An online threat modelling web application including system diagramming and a rule engine to auto-generate threats/mitigations.

  • Microsoft Threat Modeling Tool - Microsoft Threat Modeling Tool 2016 is a tool that helps in finding threats in the design phase of software projects.

  • Owasp-threat-dragon-gitlab - This project is a fork of the original OWASP Threat Dragon web application by Mike Goodwin with Gitlab integration instead of GitHub. You can use it with the Gitlab.com or your own instance of Gitlab.

  • Raindance - Project intended to make Attack Maps part of software development by reducing the time it takes to complete them.

  • Threatspec - Threatspec is an open source project that aims to close the gap between development and security by bringing the threat modelling process further into the development process.

  • PyTM - PyTM is an open source project providing a library for threat modeling with code. Describe your system using OO syntax (object.property = value) and have your threat modeling report automatically generated. 100+ threats currently supported.

  • MAL - MAL is an open source project that supports creation of cyber threat modeling systems and attack simulations.

  • Threagile - Threagile is an open-source toolkit for agile threat modeling

  • TicTaaC - Threat modeling-as-a-Code in a Tick (TicTaaC). Lightweight and easy-to-use Threat modeling solution following DevSecOps principles

  • Threat Modeling Online Game - Online version of the Elevation of Privilege and Cornucopia card games. The easy way to get started with threat modeling.

  • Deciduous - A web app that simplifies building attack decision trees. Hosted at https://www.deciduous.app/

  • drawio-threatmodeling - A collection of custom libraries to turn the free and cross-platform Draw.io diagramming application into the perfect tool for threat modeling.

  • Threat composer - A simple threat modeling tool to help humans to reduce time-to-value when threat modeling. Try the hosted version on awslabs. Data is persisted only client-side within the browser (100% local storage).

Paid tools

  • Irius risk - Iriusrisk is a threat modeling tool with an adaptive questionnaire driven by an expert system which guides the user through straight forward questions about the technical architecture, the planned features and security context of the application.
  • SD elements - Automate Threat Modeling with SD Elements.
  • Foreseeti - SecuriCAD Vanguard is an attack simulation and automated threat modeling SaaS service that enables you to automatically simulate attacks on a virtual model of your AWS environment.
  • Tutamen Threat Model system - This tool allows threat model metadata to be added to any software diagram, turning that diagram into a threat model. It's simple to use, requires no lock-in license, and is driven by the Common Weakness Enumeration, STRIDE and OWASP Top 10.
  • YAKINDU Security Analyst - YAKINDU Security Analyst is a model-based software tool for threat analysis and risk assessment of technical systems. You can identify your protection needs, analyze possible threats and calculate the resulting risks. The underlying assessment model and calculation logic are highly customizable and can be integrated into existing toolchains.

Sponsor

Practical DevSecOps

Contributing

Please refer the guidelines at contributing.md for details.

About

A curated list of threat modeling resources (Books, courses - free and paid, videos, tools, tutorials and workshops to practice on ) for learning Threat modeling and initial phases of security review.

Resources

License

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages

  • Dockerfile 100.0%