Lion Cipher Lab
Threat model a system with STRIDE using OWASP Threat Dragon
- AppSec / DevSecOps
- Beginner
- ~45 min
- Free · no account required
Why it matters
Almost every hands-on security tool finds problems after the software already exists and is running — which means the design decision that created the flaw was made months earlier, and fixing it now is expensive, disruptive, and sometimes impossible. Threat modeling flips that: you sit down at design time, before or early in the build, and reason about what could go wrong while the answer is still a cheap edit to a diagram. STRIDE is the beginner-friendly way in — six named categories of threat that turn a vague "is this secure?" into a structured walk you can actually finish. Doing it in…
What you'll learn
- threat modeling at design time
- the four-question framework
- drawing a data-flow diagram (DFD)
- trust boundaries
- walking STRIDE per element
- recording threats and mitigations
- ranking findings by risk
Steps in this lab
- The four questions — what threat modeling actually is
- Answer question one: draw a data-flow diagram
- Draw the trust boundaries — where the danger lives
- STRIDE — the six things that can go wrong
- Set up OWASP Threat Dragon and rebuild your DFD
- Walk STRIDE per element and record threats with mitigations
- Rank by risk, then answer question four
- The reality: it is a conversation, and it is never done