Intro

We aim to improve product and software security with our new threat modeling playbook. We consider threat modeling as a foundational activity to improve your software assurance. We are convinced that a good threat modeling practice will measurably decrease security issues of delivered products.

As strong believers in open source, active OWASP collaborators and to increase our impact beyond our Toreon customers, we donate this threat modeling playbook to the community.

We hope you will use this playbook to improve your threat modeling practice. We also encourage you to provide feedback to our OWASP threat modeling community in order to make this playbook even better in our next release.

I thank our collaborators (in alphabetic order): Jonas Muylaert, Joris Van den Broeck, Sebastien Deleersnyder, Steven Wierckx and Thomas Heyman to help us create this first release. I also thank Toreon for its decision to donate this work to the threat modeling community.

Sebastien Deleersnyder

CEO Toreon

OWASP volunteer

10 September 2020

PDF version

We released our threat modeling here in markdown. If you are interested in the PDF version, it is available for download on our website.

Diagram

Table of contents

1. Introduction

2. Get stakeholder buy-in

3. Embed in your organization

4. Train your people to threat model

5. Strengthen your threat model processes

6. Innovate with threat model technology

Authors

• Sebastien Deleersnyder

• Steven Wierckx

• Joris Van Den Broeck

• Thomas Heyman

• Jonas Muylaert

License

This work is licensed under a Creative Commons Attribution 4.0 International License.