Elevation of Privilege (EoP) Threat Modeling Card Game for Developers

Name: Elevation of Privilege (EoP) Threat Modeling Card Game for Developers
Brand: Agile Stationery
Price: 22.00 GBP
Availability: InStock

£22.00

EU customers: Taxes included. No additional charges (including duties) on delivery.

Description

Elevation of Privilege is a card game that helps developers find security risks by asking one simple question: What could go wrong?

Created by threat modeling expert Adam Shostack, Elevation of Privilege gives engineering teams a practical, STRIDE-based method for identifying security threats in the systems they design and build.

The cards provide the prompts. Your developers bring the system knowledge.

Use it to make threat modeling a repeatable part of development, helping teams recognise security risks earlier and reducing their dependence on centrally facilitated sessions.

Experience the game

Bulk Pricing

Automatically applied at checkout:

Buy	Discount
5 or more decks	5% off
10 or more decks	10% off
20 or more decks	15% off
30 or more decks	20% off

Specifications

Suits

Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege
# Cards

88
Created by

Adam Shostack

Outcome

Practical experience applying STRIDE to a realistic architecture.
Greater confidence identifying and discussing security threats.
Examples of documented threat scenarios.
A common language for collaborating on software security.
A repeatable technique for introducing threat modelling into development activities.

Try a branded version

If you'd like to encourage the use of this technique within your team or organisation, a branded deck is a great way to demonstrate your support and commitment to the process.

Why not just send developers on a threat modeling course?

First, training courses are expensive. And secondly, the outcome of a threat modeling course is a trained threat modeler.

Developers already have a job. You don't necessarily want to turn them into security specialists, burden them with new responsibilities, or take them away from building software.

Instead, imagine giving them a small, structured and repeatable process they can follow whenever they're working on something new. A manageable amount of threat modeling, with a predictable scope, that fits naturally into their existing routines. With our games, you're giving developers the tools to identify threats themselves, without needing a security specialist to lead every session.

The bottom line? You can scale threat modeling across your engineering teams without having to scale your security team, or your training budget, at the same rate.

How the game works?

Start with a simple diagram of the system, feature, application, API, or data flow you want to review.

Players take turns playing cards from the deck. Each card describes a possible type of security threat and prompts the group to ask whether that threat could apply to the system.

When the team finds a useful threat, they capture it and decide what should happen next.

Download the instruction cards

Sucess Stories

See how teams and organisations around the world are transforming threat modelling and security collaboration through play.

Please select Sucess Stories
'Play to Learn' workshop kit

A ready-made system architecture and guided exercise you can run with your team to experience the game before using it on your own systems.

Please select 'Play to Learn' workshop kit
2 hours 'Play to Learn' workshop

Join a session online where we will run an exclusive session with your team using physical cards so they can experience the game first-hand and see how it works!

Please select 2 hours 'Play to Learn' workshop