Build threat modeling skills with practical advanced techniques to enhance risk analysis, optimize security measures, and stay ahead of emerging threats in the complex cybersecurity landscape
Key Features
Identify and mitigate security threats across software, cloud, mobile, IoT, and supply chains using STRIDE, PASTA, and MITRE ATT&CK
Learn from real-world case studies showing practical threat modeling applications across industries
Build threat modeling programs with the right team, tools, SDLC integration, and continuous improvement
Purchase of the print or Kindle book includes a free PDF eBook
Book DescriptionThreat modeling has become a cornerstone of modern cybersecurity, yet it is often overlooked, leaving security gaps that attackers can exploit. With the rise in system complexity, cloud adoption, AI-driven threats, and stricter compliance requirements, security teams need a structured approach to proactively stop and spot risks before attackers do. This book does exactly that by providing actionable insights into leveraging industry best practices and emerging technologies to secure systems.
It breaks down the fundamentals of threat modeling and walks you through key frameworks such as STRIDE and PASTA, helping you choose the right model and create a roadmap tailored for business. You'll see how to use leading threat modeling tools, identify and prioritize potential threats, and integrate these practices into the software development lifecycle to catch risks early. The book also examines how AI can strengthen analysis and streamline security decision-making for faster, stronger defenses.
By the end, you'll have everything you need to build systems that anticipate and withstand evolving threats, keeping your organization secure in an ever-changing digital landscape.What you will learn
Explore threat modeling methodologies such as STRIDE, DREAD, and PASTA and learn how to apply them
Identify threats using attack libraries and industry standards like OWASP and CAPEC
Analyze real-world case studies from industry incidents and how threat modeling is applied in various scenarios
Evaluate popular threat modeling tools and resources and compare open-source and commercial solutions
Master advanced topics, including threat modeling for cloud environments and DevSecOps integration
Who this book is forThis book is for cybersecurity professionals, security consultants, penetration testers, and compliance managers seeking to integrate threat modeling into their assessment methodologies and client engagements. It's also ideal for software architects, DevOps engineers, risk managers, and organizational leaders responsible for identifying, assessing, and mitigating security risks in their technological environments. Whether you're new to threat modeling or looking to enhance your existing expertise, this book helps you with foundational knowledge as well as advanced techniques.
Sprache
Verlagsort
Maße
Höhe: 235 mm
Breite: 191 mm
ISBN-13
978-1-80512-825-0 (9781805128250)
Copyright in bibliographic data and cover images is held by Nielsen Book Services Limited or by the publishers or by their respective licensors: all rights reserved.
Schweitzer Klassifikation
Derek Fisher has nearly 30 years of experience in cybersecurity and engineering, having worked across a wide range of sectors including finance, healthcare, military, and commercial industries. His extensive background encompasses roles in hardware, software, and cybersecurity engineering, positioning him as a leader in securing complex systems and infrastructures. Derek is the author of several notable books, such as The Application Security Program Handbook and the Alicia Connected series-a unique initiative aimed at educating children about cybersecurity through engaging stories. His contributions extend to his Substack and YouTube channel, where he shares expert insights and fosters community engagement in the ever-evolving field of cybersecurity. Beyond his written work, Derek serves as an advisor to Temple University's Cyber Defense and Information Assurance (Cyber DIA) program and teaches software security as an adjunct professor. His courses, offered to both graduate and undergraduate students, reflect his commitment to developing the next generation of cybersecurity professionals. As a sought-after speaker and panelist, Derek regularly discusses topics like product security, vulnerability management, threat modeling, DevSecOps, and cybersecurity career growth. Passionate about empowering future cybersecurity leaders, Derek actively engages in initiatives that promote grassroots education and mentorship. He collaborates with peers and industry stakeholders to create opportunities for aspiring professionals, ensuring that the cybersecurity community continues to thrive and innovate.
Table of Contents
Threat Modeling Methodologies
Understanding and Evaluating Threats and Risks
Prioritizing Risks Found in Threat Modeling
Threat Modeling of Software
Threat Modeling of Cloud and Infrastructure
Threat Modeling the Supply Chain
Mobile and IoT Threat Modeling
AI and the Threat Modeling of LLMs
Building a Threat Modeling Practice
Future Directions in Threat Modeling
