Skip to Content

Certified Threat Modeling Professional (CTMP)  


Request for price


Length: 5 day (40 hours)

 

The CTMP program is a hands-on specialization that moves beyond the "checklist" approach to security. It focuses on identifying architectural flaws before a single line of code is written or deployed.

The curriculum is built around the "Threat Modeling as Code" philosophy, teaching you how to use automated tools to scale security across hundreds of microservices. You will learn to navigate various frameworks (STRIDE, PASTA, VAST) and integrate them directly into CI/CD workflows, ensuring security keeps pace with development.

Security Fundamentals: A solid grasp of the CIA Triad (Confidentiality, Integrity, Availability) and common web vulnerabilities (OWASP Top 10).

SDLC Knowledge: A basic understanding of how software is built, specifically within Agile or Scrum environments.

Technical Literacy: Comfort using a command-line interface (CLI) and basic familiarity with application architecture (e.g., how a frontend talks to an API).

No Prior Modeling Experience: This course is designed to take you from zero to professional-level modeling.

Security Engineers & Architects: Who need a structured way to review system designs for vulnerabilities.

DevSecOps Professionals: Looking to automate threat modeling within the pipeline.

Developers & Tech Leads: Who want to build "Security by Design" into their products.

Penetration Testers: Who want to move "upstream" to find design flaws that can't be fixed by simple patches.

Compliance Officers: Tasked with meeting "Secure by Design" regulatory requirements.

Course objectivesCourse outlines

Course objectives

After completing this course, students will be able to:

    • Think Like an Attacker: Systematically identify entry points, trust boundaries, and potential exploit paths.
    • Apply Multiple Frameworks: Select the right methodology (STRIDE for software-centric, PASTA for business-centric, etc.) for any project.
    • Master Diagramming: Create professional Data Flow Diagrams (DFDs) and Attack Trees that clarify complex system risks.
    • Implement "Threat Modeling as Code": Use tools like OWASP Threat Dragon, IriusRisk, and PyTM to automate the modeling process.
    • Prioritize with Precision: Use DREAD or OWASP Risk Rating to decide which threats require immediate remediation.
    • Bridge the Dev-Sec Gap: Translate abstract threats into actionable "Abuser Stories" and Jira tickets for developers.

Course outlines

    • Module 1: Foundational Threat Modeling
      • The Parlance of Threats: Defining Trust Boundaries, Attack Surfaces, and Entry Points.
      • Methodology Comparison: List-centric vs. Asset-centric vs. Software-centric models.
      • Risk Strategies: Navigating the "Big Four" (Avoid, Mitigate, Transfer, Accept).
    • Module 2: The STRIDE Framework & Beyond
      • Deep Dive into STRIDE: (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege).
      • STRIDE Defenses: Mapping threats to specific technical controls (e.g., OAuth for Spoofing, TLS for Tampering).
      • Advanced Frameworks: Introduction to PASTA (Process for Attack Simulation and Threat Analysis) and VAST.
    • Module 3: Agile & DevOps Integration
      • Threat Modeling at Scale: Moving from manual whiteboarding to automated, repeatable processes.
      • Writing Security Requirements: Creating User Stories and "Abuse Cases" for sprint planning.
      • CI/CD Integration: Triggering threat model updates during the build process.
    • Module 4: Cloud-Native & Real-World Case Studies
      • Modeling the Cloud: Identifying risks in AWS S3 configurations and Kubernetes clusters.
      • Microservices: Handling trust boundaries in distributed environments.
      • Native Apps: Modeling legacy vs. modern containerized applications.
    • Module 5: Reporting & Tooling
      • Tool Mastery: Hands-on labs with OWASP Threat Dragon, Cairis, and Threagile.
      • The Final Output: Delivering reports that both C-suite executives and engineers can understand.