Elevation of Privilege Threat Modeling with Privacy

£24.00

Volume discounts (automatically applied at checkout)

10% off on 5 or more decks
15% off on 10 or more decks
20% off on 20 or more decks
30% off on 30 or more decks

Outcome

Identify security work that needs doing earlier in the project lifecycle. Defuse difficult relationships. Build trust. Bring teams together in peace and harmony.

Made by Agile Stationery

Experts in delivering the right kind of conversations. Slick cards in robust boxes. The best there is outside the casinos.

102 cards

The Elevation of Privilege (EoP) card game offers a structured and engaging approach to threat modeling, enabling development teams to identify potential security vulnerabilities early in the design process.

Created by Adam Shostack, EoP simplifies the complex task of threat modeling by categorising threats into six suits based on the STRIDE mnemonic: Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege.

This extended edition 102 cards contains additional threat cards with privacy anti-patterns, helping developers to spot common privacy and data handling errors as well.

Set the stage

Before dealing, sketch a simple diagram of the system on a whiteboard, paper, or digital tool, just enough to show key components and data flows.
Deal the cards

Shuffle the deck and deal all the cards to 3-6 players. Each player organizes their hand by suit (but no peeking at your neighbour’s cards!).
Let the game begin

The player with the 2 of Tampering starts. Read your card and explain how the threat could affect the system.
Winning

Players take turns with the threats in that suit, with the highest card winning the round. The winner leads the next
round until all cards are played.