Lion Cipher Lab
Build a test plan from a threat model and measure its coverage
- Penetration Testing / Red Team
- Intermediate
- ~40 min
- Free · no account required
Why it matters
A penetration test is only as good as its choice of what to try. Without a plan, testers spend their time on whatever looks interesting, often well-known vulnerability classes, while the threats that matter most for this particular application go untested. A threat model fixes that. It lists what could go wrong for this system, component by component, often organised with Microsoft's STRIDE categories: spoofing, tampering, repudiation, information disclosure, denial of service and elevation of privilege. The OWASP Threat Modeling Cheat Sheet describes the process, and the OWASP Web Security…
What you'll learn
- threat modeling with STRIDE
- turning threats into test cases
- referencing test cases to the OWASP WSTG
- tracing tests to threats in both directions
- measuring coverage by STRIDE category
- planned, executed and blocked tests
- recording deliberate exclusions honestly
Steps in this lab
- From threats to tests
- The threat model and the plan
- Write the coverage check
- Run it and read the gaps
- Close the gaps, and record what is excluded on purpose