Professional development

Threat modeling has huge benefits, says Infosec Skills author Geoffrey Hill

New Infosec Skills author Geoffrey Hill humbly considers himself a jack of all trades, but unlike the old adage, the “master of none” part does not apply.

In addition to designing the new Infosec Skills Threat Modeling Learning Path, Geoffrey is the director of a consulting company, runs a software company and regularly delivers onsite threat modeling courses in his home base of London. He wouldn’t have it any other way.

Get your free course catalog

Download the Infosec Skills course catalog to learn more about these courses — and hundreds more.

Download Now

 

What is threat modeling?

 

“I’ve had a passion for threat modeling since the early 2000s,” Geoffrey said. “Back in the early days there was little thought for including protective measures during a project’s construction. Problems were discovered late and people often had to scrap the whole thing, often right before it was supposed to go live.”

Threat modeling is similar to pentesting, but at a much higher level: before any code is written. Geoffrey said it usually involves just a handful of people, such as a threat modeling professional along with an architect or a couple designers.

“That's why it's so cheap and effective, because nothing has been created. All you're starting with is a piece of paper and a drawing. You pentest. You poke holes in it. When you're finished, you've found a bunch of potential issues. By the time the developers get it, it's more efficient for them to just build security in because they're not doing it as an afterthought.” 

 

Infosec Skills threat modeling training

 

Geoffrey’s Threat Modeling Learning Path includes six courses and introduces you to threat modeling with Rapid Threat Model Prototyping (RTMP). Beginning with a top-level view of threat modeling, you'll look at core security frameworks, elements of a threat model, threat modeling basics, agile architecture and end with a lab to bring all the information together. 

The courses are designed for security-focused developers, architects, testers and business analysts looking for a well-rounded, well-organized training.

“Early in the course, we study concepts such as the attack kill chain,” Geoffrey said. “Then we get into the layers of security and systems, adding two or three new elements in each course that build on the core ideas. You're learning threat modeling at the speed of light, I like to say.”

 

 

Learn Threat Modeling

 

 

Benefits of learning threat modeling

 

Like other LX Labs experts, Geoffrey has a passion for training and sharing his expertise.

“I got the love for training while at university. A few of my teachers were excellent and inspiring, and I wanted to be like them,” said Geoffrey, who worked at Microsoft for nearly a decade before getting the chance to teach threat modeling to employees and clients. “I discovered I really liked it, especially engaging with learners. I got to watch the light bulb go off when they finally understood a concept.” 

Threat modeling is especially exciting, Geoffrey said, because it has a “triple whammy” benefit for security professionals.

“It's easy to teach. It's easy for people to learn. And it's inexpensive to roll out.”

 

New cybersecurity professionals need humility

 

Geoffrey likes to advise those just entering the field to keep a little humility in their toolbox.

“I always think to myself, ‘I'm not the smartest person in the room and I might have missed something,’” Geoffrey said. “You need to plan for the anticipated and the unanticipated. Time and time again I've found that when I’m over-confident and make an assumption, it gets thrown back in my face.”

It’s a valuable lesson for those new to cybersecurity, he said.

“There's a saying, ‘old age and treachery always beats youth and skill.’ It's that way in cybersecurity. There are the older hackers and attackers out there, and they know a lot of tricks of the trade. Never go in with the assumption that because you're a smart person, you're the smartest person in the room.”

 

See Geoffrey's courses

 

FREE role-guided training plans

Get 12 cybersecurity training plans — one for each of the most common roles requested by employers.

Download Now

About Geoffrey Hill

Geoffrey Hill has been in the IT industry since 1990, when he wrote and sold C++ based solutions to measure risk in the commodities markets in New York City. Since then he has worked around the world, specifically New York, Sydney, Tokyo, Emmerich-am-Rhein and London. In the mid 2000s, He was the main custodian of the Microsoft Security Development Lifecycle (SDL) initiative in the UK and then international services organization as part of the Microsoft Security Center of Excellence (SCOE). From 2013 – 2018, he worked as the sole application security architect for Visa Europe in London, where he started Tutamantic Ltd, a producer of software risk automation. Geoff is the inventor of the Rapid Threat Model Prototyping (RTMP) methodology. This threat model methodology allows for quick modelling in Agile and DevOps environments.