Threat Modeling Template and Concepts v0.6

Here is an updated version of Threat Model Template v0.5  and a new Threat Model Concepts page.

You can download the pdfs and draw.io files from this GitHub repo

Threat Model Template v0.5

Here is a an improved simple Threat Model template which contains info about STRIDE and DFD Elements (which is based on the diagram shown at Threat Model WebServices v0.2)

You can download both PDFs from here

Threat Model WebServices v0.2

Here is an experiment in trying to create an Threat Model (A3 size) that can be easily consumed during the Threat Model session(s).

This diagram was created using https://www.draw.io/ which is pretty amazing (and allows team collaboration):

Simple Threat Model (template) - Good place to start

When teaching about Threat Models, the most common question I get is 'How do I start?'.

To make this process easier, I usually recommend to use the simple '1 page Threat Model' which you can see on the right ( download here)

The idea is to kickstart the process by mapping out the:

1. Data Flow Diagrams (i.e app architecture)
2. Entry Points (i.e Attack surface)
3. Assets (i.e. what is valuable and needs to be protected)
4. External Dependencies and Trust Levels
5. Threats(edited)

Another great source of (first steps on Threat Modelling) resources are the Microsofts' At a Glance: Web Application Threat Modeling and OWASP's Application Threat Modeling pages