Application Threat Modeling in real life

At the end of this chapter, I will provide a practical sample of an ATM document. If you feel that any of the items that I'm trying to discuss here are not clear (very theoretical), then I invite you to look at the example at the end of this chapter. If you want your team to be successful during the pentest phase, then you must do an ATM document prior to your penetration test activities. Let's take an example that I witness on a daily basis when I use this approach. A new project comes in, and the Project Manager (PM) contacts management, asking for an expert in application security, because they're going to build a new website. The management team then assigns you to that new project, which is still in the Architecture phase. You attend a couple of meetings to understand the contents of the project. Most probably, another...