Elevation of Privilege (EoP) Threat Modeling Card Game for Developers
Description
Description
Elevation of Privilege is a card game that helps developers find security risks by asking one simple question: What could go wrong?
Designed by Adam Shostack, the game includes a structured deck of threat modelling cards based on STRIDE. It gives teams a practical way to discuss threats, challenge assumptions, and improve system designs before problems become expensive to fix.
You do not need to be a security expert to take part. The cards provide the prompts. The team provides the system knowledge. Together, you uncover useful threats and turn them into practical actions.
Outcome
Outcome
- Practical experience applying STRIDE to a realistic architecture.
- Greater confidence identifying and discussing security threats.
- Examples of documented threat scenarios.
- A common language for collaborating on software security.
- A repeatable technique for introducing threat modelling into development activities.
Bulk Pricing
Bulk Pricing
Automatically applied at checkout:
| Buy | Discount |
|---|---|
| 5 or more decks | 5% off |
| 10 or more decks | 10% off |
| 20 or more decks | 15% off |
| 30 or more decks | 20% off |
Elevation of Privilege (EoP) Threat Modeling Card Game for Developers
Specifications
Specifications
-
SuitsSpoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege
-
# Cards
-
Created by
-
Standards & Compliance-
Try a branded version
If you'd like to encourage the use of this technique within your team or organisation, a branded deck is a great way to demonstrate your support and commitment to the process.
Why teams use Elevation of Privilege?
Elevation of Privilege works because it gives everyone a way into the conversation.
Developers understand the system. Product owners understand business impact. Testers think about failure. Security teams bring specialist knowledge. The game gives all of them a shared structure for discussing risk.
How the game works?
Start with a simple diagram of the system, feature, application, API, or data flow you want to review.
Players take turns playing cards from the deck. Each card describes a possible type of security threat and prompts the group to ask whether that threat could apply to the system.
When the team finds a useful threat, they capture it and decide what should happen next.
Help your company say yes to the game
-
Sucess Stories
See how teams and organisations around the world are transforming threat modelling and security collaboration through play.
-
'Play to Learn' workshop kit
A ready-made system architecture and guided exercise you can run with your team to experience the game before using it on your own systems.
-
1.5 hour 'Play to Learn' session
Join a session online where we will run an exclusive session with your team using physical cards so they can experience the game first-hand and see how it works!
How to play Elevation of Privilege
Watch this short video to learn the basics of the game or take a look at this presentation by Adam Shostack for his Black Hat talk.
Play to learn EoP with the creator of the game?
A unique opportunity to take part in an Elevation of Privilege game, guided by the game's creator and threat modelling expert, Adam Shostack.
