Work out what could go wrong with a system before it does, well enough to produce a short list of the things actually worth defending, to justify leaving the rest, and to repeat the exercise on a design in an hour

Thinking Like an Attacker

Threat modelling is often a ceremony that produces a document nobody reads. This course makes it a short, repeatable exercise: draw the system, find the boundaries, enumerate the threats, and decide what you are not going to do.

8 lessons, written and corrected before you arrived. Reading them here needs no account. The first reads the whole way through; the others open and then stop, because a page nobody owns cannot tell who is reading it. Starting the course gives you your own copy, where every idea has problems standing under it and you can ask about any sentence.

Start reading

01Start With What You Would Hate to LoseBefore any mention of attacks, write down what the system holds and what would be bad about losing it. A threat list with no sense of loss becomes a list of everything.
02The Drawing Is Where the Findings Areopening onlyDraw what the system actually is, including the parts nobody puts on architecture diagrams, then mark every line where data crosses between differently trusted things.
03Nobody Attacks You in Generalopening onlyDescribe your attackers by what they can do and what they want, not by how frightening they sound. Then throw away the threats that are real and have nothing to do with you.
04A Checklist Beats Being Cleveropening onlyAsk the same six questions at every boundary on the drawing. The output is a list with a known shape, which is worth more than whatever the most imaginative person in the room thought of.
05Three Harmless Things in a Rowopening onlyReal incidents are rarely one dramatic failure. They are three or four findings nobody would have fixed, arranged in an order, each one making the next one possible.
06Rank by Loss, Not by Frightopening onlyA list of findings in no order is a list nobody acts on. Rank them by how much you would plausibly lose, with the two numbers written down so the order can be argued with.
07Most of the List Is Not Going to Be Fixedopening onlyYou will not fix most of what you found, and that is the correct outcome. Write each one down as a decision with a reason, an owner and a date, so it is not an oversight.
08Hook It to the Things That Changeopening onlyA threat model is accurate on the day it is written and wrong within two quarters. Attach it to the changes that invalidate it rather than to a date in a calendar.