Let’s Go Threat Modelling

Richard Adams's profile
Richard Adams

Senior Quality Engineer

Challenge Description

This activity is an opportunity to learn how to adopt threat modelling and what a session might look like, using Richard Adams’s card game. The goal is to show you how Threat Modelling works and also that threat modelling isn't for security engineers or lead developers. If anything, the tester mindset gives us the advantage. 


  1. Download the “Threat Model” and “Threat Modelling Table” handouts that accompany this activity.

  2. Go through each of the “Threat Agent” entries in the “Threat Modelling” table and identify a type of attack that might be carried out for each one.

For example, for Denial of Service, we could suggest that a DDOS attack in which a Web API is flooded with requests might be an attack to be concerned about.

Tip: Find resources online or discuss with one another what each of the threat types are and what types of attacks might be connected to them.


This activity shows how creating a model of a system and then applying the STRIDE mindset, can help us pick out potential threats. As testers we’re good at identifying risks and that skillset comes in handy when assessing for security threats, even if you might not know how to execute them.

What you’ll learn
  • Analyse visual models to spot security threats
  • Use STRIDE mnemonic to break down each of the types of threats


This activity requires that you download the following documents:


10 Great Questions from Tester to Architect
Understanding Your Domain: Research for Testing - Melissa Eaden
The Hypocrisy of Hypotheses (Or, How do we test hypothesis driven acceptance criteria) - Sharon McGee
Testing or Hacking? Real Advice on Effective Security Testing Strategies – Dan Billing
FinTech Testing 101
Making Security Testing More User Friendly
Bing! Goes a Brain Wave (Heuristics and Mnemonics for Mobile Apps)
The Surprising Benefits of Exploring Other Disciplines and Industries - Conor Fitzgerald
Model Fatigue and How to Break It – John Stevenson
Explore MoT
Episode Four: The Practitioner
The Testing Planet is a free monthly virtual community gathering produced by Ministry of Testing
Introduction To Accessibility Testing
Learn with me about what Accessibility is, why it's important to test for and how to get your team started with an Accessibility testing mindset