threat-modeling-study-plan.md

Threat Modelling

What is Threat Modeling

Threat modelling is a structured approach for analysing the security of an application and enables to identify, quantify, and address the security risks associated with an application. From details about threats and likely attacks against each application, the organization operates more effectively through better decisions about prioritization of initiatives for security. Additionally, decisions for risk acceptance are more informed, therefore better aligned to the business.

In short,

• Threat modeling is the process of identifying, analyzing, and mitigating potential security threats to a system or organization.
• It involves identifying the assets that need to be protected, analyzing the potential threats to those assets, and developing strategies to mitigate or eliminate those threats.
• The early you perform Threat Modeling the better result you would get.

The objective to conduct threat modelling is to investigate following:

1. The trust boundaries to and within the application
2. The actors that interact within and outside of the trust boundaries
3. Information flows within and to and from the trust boundaries
4. Information persistence within and out of trust boundaries
5. Threats to transgression of trust boundaries by actors and for information flow and persistence
6. Vulnerabilities at trust boundaries as accessed by actors and for information flow and persistence
7. Threat agents that can exploit the vulnerabilities
8. Impact of exploitation of vulnerability by a threat agent
9. Decision tree to treat the risk

ToC

1. Threat Modeling Fundamentals - 2 weeks
2. Methodologies - 2 weeks
3. Process and Tools - 2 weeks
4. Advanced Topics and Practice - 2 weeks
5. Resources

Threat Modeling Fundamentals

Duration: 2 weeks

Understand the "Why" and "What" of Threat Modeling.

Week 1-2: Core Concepts

• Definition: Identifying, analyzing, and mitigating potential security threats.
• Why it matters: Proactive identification, cost efficiency, prioritization.
• Key Elements:
  • Assets: What are we protecting?
  • Threats: What can go wrong?
  • Vulnerabilities: Where are we weak?
  • Mitigations: What are we going to do about it?
• The 4 Questions:
  1. What are we building?
  2. What can go wrong?
  3. What are we going to do about it?
  4. Did we do a good job?

Methodologies

Duration: 2 weeks

Learn the structured approaches to finding threats.

Week 3-4: Frameworks

1. STRIDE: Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege. (Focus heavily on this).
2. PASTA: Process for Attack Simulation and Threat Analysis (Risk-centric).
3. Attack Trees: Visualizing attack paths.
4. Other models: CVSS (scoring), DREAD (scoring), LINDUNN (privacy).
5. MAESTRO (agentic AI): Multi-Agent Environment, Security, Threat, Risk, and Outcome — the Cloud Security Alliance's layered threat modeling framework for agentic AI, published 6 February 2025.
   • STRIDE, PASTA and LINDDUN assume deterministic software logic. MAESTRO instead decomposes an agentic system into seven layers and enumerates threats per layer and across layers:
     1. Foundation Models
     2. Data Operations
     3. Agent Frameworks
     4. Deployment and Infrastructure
     5. Evaluation and Observability
     6. Security and Compliance (a cross-cutting/vertical layer)
     7. Agent Ecosystem
   • Use it when agent-to-agent trust, orchestration logic and delegated tool use matter more than a single data flow. It is complementary to STRIDE, not a replacement — many teams run STRIDE on the conventional application and MAESTRO on the agentic layer.
   • It has become the de-facto shared vocabulary for agentic threat modeling: OWASP's Agentic Security Initiative work maps to MAESTRO layers (for example, OWASP AIVSS scores agentic findings against the OWASP Agentic AI Top 10 and CSA MAESTRO layers).
   • Further reading: MAESTRO on GitHub (CSA) and Applying MAESTRO to Real-World Agentic AI Threat Models: From Framework to CI/CD Pipeline (CSA, Feb 2026).

Process and Tools

Duration: 2 weeks

How to actually do it in a real project.

Week 5-6: Execution

1. Data Flow Diagrams (DFDs):
   • Trust boundaries.
   • Processes, Data Stores, Data Flows, External Entities.
2. The Process:
   • Define Scope -> Decompose Application -> Identify Threats -> Mitigate -> Validate.
3. Tools:
   • OWASP Threat Dragon: Open source, web/desktop based.
   • Microsoft Threat Modeling Tool: The classic standard.
   • Threagile: Agile, code-driven threat modeling.

Advanced Topics and Practice

Duration: 2 weeks

Scaling and integrating into SDLC.

Week 7-8: Scaling & Integration

1. Integration: How to fit TM into Agile/DevOps (Rapid Threat Modeling).
2. Validation: Verifying mitigations through testing (pentesting, unit tests).
3. Practice:
   • Model a simple web app.
   • Model a cloud infrastructure (e.g., S3 bucket setup).
   • Model a CI/CD pipeline.
   • Model an agentic AI feature (an LLM agent with tools and memory) using MAESTRO, then compare what a plain STRIDE pass would have missed.

Threat Modeling tools to explore

1. OWASP Threat Dragon
2. Microsoft Threat Modeling Tool
3. STRIDE GPT
4. Threagile - run agile threat modeling
5. PyTM - a Pythonic Framework for Threat Modeling
6. draw.io is also a good tool to draw threat model diagram

Resources to learn and practice

1. https://owasp.org/www-project-threat-dragon/
2. https://owasp.org/www-community/Threat_Modeling
3. https://www.simplilearn.com/what-is-threat-modeling-article
4. https://www.synopsys.com/glossary/what-is-threat-modeling.html
5. https://www.eccouncil.org/threat-modeling/
6. https://komsr3ll.medium.com/threat-modelling-attack-vectors-4f4989336588
7. Mindmap of a threat model used by Red Team
8. Cyber Threat Modeling by MITRE
9. https://redcanary.com/blog/threat-modeling/
10. https://www.jemurai.com/2020/11/10/risk-and-threat-modeling-with-mind-maps/
11. https://shellsharks.com/threat-modeling
12. Clone this repo for more resources: Awesome Threat Modeling by @secfigo
13. Threat Modeling Podcast by Chris Romeo
14. Threat Modeling learning resources: Linkedin Post
15. Certified Threat Modeling Professional by Practical DevSecOps
16. Kubernetes Threat Modeling
17. AWS S3 Threat Modeling - One you think you are ready for real time projects
18. MAESTRO: Agentic AI Threat Modeling Framework (Cloud Security Alliance, Feb 2025) and the MAESTRO repo
19. OWASP Agentic Security Initiative - agentic threat taxonomies, Top 10 for Agentic Applications, and AIVSS scoring
20. Microsoft: Threat Modeling AI/ML Systems and Dependencies

Video Resources :bulb:

1. https://youtu.be/h_BC6QMWDbA
2. https://youtu.be/GqmQg-cszw4
3. https://youtu.be/fggB70PxhmA
4. https://youtu.be/lnvYlg4HOX4
5. https://youtu.be/GuhIefIGeuA
6. https://youtu.be/CjzdC0Eerfw
7. Paid Course on Udemy: Threat Modeling using STRIDE by Taimur

Books :books:

1. Threat Modeling: Design for Security by Adam Shostack
2. Threat Modeling by Izar Tarandach

After learning Threat Modeling, you can connect it with monitoring and incident response by exploring the Blue Team, Detection & Response Study Plan.

For threat modeling of GenAI, LLM and agentic systems in depth - OWASP Agentic AI Threats and Mitigations, the OWASP Top 10 for Agentic Applications 2026, AIVSS scoring and MAESTRO-adjacent material - go to the GenAI Security Study Plan instead of repeating it here.