Finding the trust boundary problems that matter at Ledgerwick Payroll on the crossing board: eight crossings, each from one zone through a named boundary gate to another — from the Spindle support console into Quire payroll runs, a pipeline runner into the production deploy role, a vendor support desk into the Spindle console and one tenant's report request into a shared cache — with control cells turning from assumed to verified and the gates turning from rose to teal. Alongside, incident INC-2026-0412, where a vendor engineer saw another employer's 212 payroll records because the old threat model drew no boundary, and the result: 37 boundaries drawn, staleness cut from 454 days to 11 and 11 design decisions changed.

CY-EXPERT-086Expert Level · Threat Modeling

Trust Boundary Scenarios

An expert-level threat modelling course on designing scenarios that find the trust boundary problems which matter, rather than a long generic threat list. Work down the Trust Boundary Crossing Board - eight rows, one per chapter: what a trust boundary is and why serious flaws sit on one; drawing the data flow diagram at the level where boundaries show; the boundaries nobody draws - admin planes, tenants, CI and production, identity providers and vendor support access; scenario design as a disciplined question at each crossing, with STRIDE as a prompt; priority by consequence and control confidence; turning each priority scenario into a design decision, a test or an owned risk; keeping the model alive through change; and evidencing it to an architecture board by the decisions it changed.

18 hours8 chapters32 lessons225 activities8 labs

What you'll learn

Explain what a trust boundary is, test an existing threat model against real failures, and write a purpose statement measured by decisions changed.
Draw data flow diagrams at the level where every change of principal, privilege or data owner is visible, and build a boundary inventory of caller, callee, credential and data.
Draw the boundaries diagrams leave out: a service and its admin plane, tenants in shared storage, CI and production, federated identity providers, and vendor support access.
Design scenarios by asking what is assumed, what is verified and what happens if the assumption is wrong at every crossing, using STRIDE as a prompt and naming the control that must hold.

Price:৳12,000