On This Page

Advanced Whiteboard Hacking aka Hands-on Threat Modeling

Toreon | December 3 - 4



Overview

Based on our successful trainings in the last years, we released this advanced threat modeling training at Black Hat USA 2018.
As highly skilled professionals with years of experience under our belts we know that there is a gap between academic knowledge of threat modeling and the real world.
In order to minimize that gap we have developed practical Use Cases, based on real life projects. Each use case includes a description of the environment, together with questions and templates to build a threat model. Using this methodology for the hands on workshops we provide our students with a robust training experience and the templates to incorporate threat modeling best practices in their daily work.
Students will be challenged to perform the threat modeling in groups of 3 to 4 people performing the different stages of threat modeling on the following:
• B2B web and mobile applications, sharing the same REST backend
• An Internet of Things (IoT) deployment with an on premise gateway and a cloud based update service
• OAuth scenarios for an HR application
• Privacy of a new face recognition system in an airport
After each hands-on workshop, the results are discussed, and students receive a documented solution.
Threat modeling is the primary security analysis task performed during the software design stage. Threat modeling is a structured activity for identifying and evaluating application threats and vulnerabilities. The security objectives, threats, and attacks modeling activities during the threat modeling are designed to help you find vulnerabilities in your application and the supporting architecture. You can use the identified vulnerabilities to help shape your design and direct and scope your security testing.
Threat modeling allows you to consider, document, and discuss the security implications of designs in the context of their planned operational environment and in a structured fashion. It also allows consideration of security issues at the component or application level. The threat modeling course will teach you to perform threat modeling through a series of workshops, where our trainer will guide you through the different stages of a practical threat model.
This course is aimed at software developers, architects, system managers or security professionals. Before attending this course, students should be familiar with basic threat modeling concepts, STRIDE, knowledge of web and mobile Applications and Single sign on (SSO) principles. The students should bring their own laptop to the course.
Some feedback from our Black Hat 2017 training attendees:
• "Sebastien delivered! One of the best workshop instructor's I've ever had."
• "Very nice training course, one of the best I ever attended."
• "I feel that this course is one of the most important courses to be taken by a security professional."
• "The group hands-on practical exercises truly helped."

Who Should Take this Course

This course is aimed at software developers, architects, system managers or security professionals. Before attending this course, students should be familiar with basic threat modeling concepts and STRIDE.

Student Requirements

The students should bring their own laptop to the course.

What Students Should Bring

laptop or tablet

What Students Will Be Provided With

The course students receive the following package as part of the course:
• Hand-outs of the presentations
• Work sheets of the use cases,
• Detailed solution descriptions of the use cases
• Template to document a threat model
• Template to calculate risk levels of identified threats
• Receive certificate: Following a successful exam (passing grade defined at 70%) the student will receive certification for successful completion of course

Trainers

Sebastien Deleersnyder will share his practical threat modeling experience. He specializes in Application Security, combining both his software development and information security experience. Sebastien has led engagements in the domain of ICT-security, Web and Mobile Security with several customers including BNP Paribas Fortis, Atos Worldline, KBC, Nationale Nederlanden (ING), Isabel, Fluxys, OLAF, EU Council, TNT Post , Flemish Community, Agfa-Gevaert and ING Insurance International. In the last 15 years he has performed several successful secure development lifecycle projects in the financial and utility sector, started up software security groups, supported customers in selecting and implementing Web Application Firewalls (WAF), delivered web application security training and closed a lot of audit findings regarding application security :-). Sebastien started the Belgian OWASP Chapter Leader, was a member of the OWASP Foundation Board and performed several public presentations on Web Application and Web Services Security. He also co-founded the yearly security & hacker BruCON conference and trainings in Belgium. Sebastien has achieved CISSP, CISM, CISA and Prince2 Practitioners certifications. Specialties: Application Security, Secure Development Lifecycle, ICT security product management, Business Development and Security Project Management