AppSecEngineer™ Certified Application Threat Modeler

• Understand the "why" and "what" of threat modeling using the 4 core questions
• Grasp the fundamentals of LLMs and prompt engineering for security
• Learn the principles of the NIST SP 800-154 framework
• Recognize the critical role of scoping, Security Objectives, and Data Dictionaries

• Articulating the business case for threat modeling
• Writing effective prompts using frameworks like COSTAR
• Defining the technical and business scope of a threat model
• Creating foundational artifacts like Security Objectives and a Data Dictionary

‍

• Understand how to deconstruct systems using Data Flow Diagrams (DFDs) and Trust Zones
• Master the application of the STRIDE framework
• Gain familiarity with the PWN-ISMS framework for analyzing threats in modern architectures

‍

• Analyzing system architecture diagrams to map data flows
• Assigning numerical Trust Zones to identify high-risk intersections
• Conducting a comprehensive threat analysis using STRIDE
• Applying the PWN-ISMS framework to identify risks across its seven domains

‍

• Learn to propose realistic and effective security controls
• Understand the NIST framework for Countermeasure Impact Analysis
• Appreciate the challenges of traditional threat modeling in agile environments
• Grasp the principles of rapid, feature-focused security analysis using Mozilla's Rapid Risk Assessment (RRA)

• Developing potential security controls
• Performing an Impact Analysis to prioritize countermeasures
• Articulating the value of "shifting left" into sprint planning
• Conducting a time-boxed Rapid Risk Assessment (RRA) for a new software feature

‍

• Master the Story-Driven Threat Modeling technique
• Understand how to create Mitigation Models and implement "Secure by Default" principles
• Learn the importance of validation and how to define Refutation Criteria
• Recognize that the goal is to produce actionable outputs for the development backlog

• Translating User Stories into security-focused Abuser Stories
• Breaking down Abuser Stories into specific Threat Scenarios
• Designing and documenting Mitigation Models for development teams
• Defining concrete validation activities and refutation criteria for identified threats