Elevation of Privilege (EoP) Threat Modeling Card Game
Description
Description
Elevation of Privilege is a card game that helps teams find security risks by asking one simple question: What could go wrong?
Designed by Adam Shostack, the game includes a structured deck of threat modelling cards based on STRIDE. It gives teams a practical way to discuss threats, challenge assumptions, and improve system designs before problems become expensive to fix.
You do not need to be a security expert to take part. The cards provide the prompts. The team provides the system knowledge. Together, you uncover useful threats and turn them into practical actions.
Bulk Pricing
Bulk Pricing
Automatically applied at checkout:
| Buy | Discount |
|---|---|
| 5 or more decks | 5% off |
| 10 or more decks | 10% off |
| 20 or more decks | 20% off |
| 30 or more decks | 30% off |
Outcome
Outcome
Identify security work that needs doing earlier in the project lifecycle. Defuse difficult relationships. Build trust. Bring teams together in peace and harmony.
Elevation of Privilege (EoP) Threat Modeling Card Game
Specifications
Specifications
-
SuitsSpoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege
-
# Cards
-
Created by
Try a branded version
If you'd like to encourage the use of this technique within your team or organisation, a branded deck is a great way to demonstrate your support and commitment to the process.
Why teams use Elevation of Privilege?
Elevation of Privilege works because it gives everyone a way into the conversation.
Developers understand the system. Product owners understand business impact. Testers think about failure. Security teams bring specialist knowledge. The game gives all of them a shared structure for discussing risk.
How the game works?
Start with a simple diagram of the system, feature, application, API, or data flow you want to review.
Players take turns playing cards from the deck. Each card describes a possible type of security threat and prompts the group to ask whether that threat could apply to the system.
When the team finds a useful threat, they capture it and decide what should happen next.
Help your company say yes to the game
-
Sucess Stories
See how teams and organisations around the world are transforming threat modelling and security collaboration through play.
-
'Play to Learn' kit
A ready-made system architecture and guided exercise you can run with your team to experience the game before using it on your own systems.
-
1.5 hour 'Play to Learn' session
Join a session online where we will run an exclusive session with your team using physical cards so they can experience the game first-hand and see how it works!
How to play Elevation of Privilege?
Watch this short video to learn the basics.
Play to learn EoP with the creator of the game?
A unique opportunity to take part in an Elevation of Privilege game, guided by the game's creator and threat modelling expert, Adam Shostack.
