Program 3 · Application Security — OWASP Top 10 and Threat Modeling

Status: in progress

The web-application vulnerability classes every engineer must know, plus the structured methodologies for identifying threats before code is written.

Program 1 introduced what threat modeling is (see Threat Modeling · intro): whiteboard-driven, STRIDE at the surface level, decomposition, DREAD. This program takes the next step:

• Grounds threat modeling in the actual vulnerability classes attackers exploit today — the OWASP Top 10:2025 — so the list of "what can go wrong" is concrete, not abstract.
• Moves past STRIDE-as-a-checklist into PASTA, LINDDUN, attack trees, MITRE ATT&CK and the other methods surveyed by the SEI, with the criteria for choosing between them.

Nothing here re-introduces the basics (proactive vs reactive, the four risk responses, STRIDE mnemonic, DREAD scoring). Where those are needed, this program links back to Program 1 rather than repeating them.

---

Modules

Module 1 · OWASP Top 10 — Web Application Security Risks

The current (2025) list, one file per category. Each entry follows a consistent structure — what the class is, root causes, prevention pattern, detection/testing, and connections to other categories.

• Overview · OWASP Top 10:2025 — history 2003→2025, how the list is compiled, what changed vs 2021, full comparison table.
• A01 · Broken Access Control
• A02 · Security Misconfiguration
• A03 · Software Supply Chain Failures
• A04 · Cryptographic Failures
• A05 · Injection
• A06 · Insecure Design
• A07 · Authentication Failures
• A08 · Software or Data Integrity Failures
• A09 · Security Logging and Alerting Failures
• A10 · Mishandling of Exceptional Conditions

Module 2 · Threat Modeling Methodologies

Where Program 1 introduced STRIDE at the surface, this module unpacks the full methodology landscape and gives criteria for choosing.

• Overview · The 12 Methods and How to Choose
• The Threat Modeling Manifesto and the Four-Question Framework
• STRIDE in Depth — DFDs, per-Element, per-Interaction
• PASTA — Process for Attack Simulation and Threat Analysis
• LINDDUN — Privacy Threat Modeling
• Attack Trees
• Alternative Frameworks — VAST, Trike, OCTAVE, hTMM, PnG, Security Cards, Quantitative TMM, CVSS
• MITRE ATT&CK — Threat-Informed Defense

---

Feeds from

• Program 1 — vulnerability, threat, risk, and countermeasure vocabulary; intro to STRIDE, DREAD and the three-stage threat-modeling loop.

Feeds into

• Program 2 · DevOps — the pipeline integration points where OWASP checks and threat models actually run (SAST/DAST/SCA/threat-modeling-as-code).
• Program 4 · Data, Privacy and AI Security — the same threat-modeling vocabulary applied to data and ML systems, which add their own threat classes (e.g. PLOT4ai for AI).