From threats to tests
On This Lesson 4 topics
This lesson is planned. The outline below lists the topics it will cover. The full lesson has not been published yet.
In this lesson
make every important threat a test or backlog item.
Planned topics
- Rank threats by impact and likelihood; handle the top ones first.
- Each mitigation gets a test: BOLA test, role test, rate-limit test.
- Unfixed threats become backlog items with an owner and a risk-acceptance note.
- Revisit the model when a new flow, service, or data store appears.
Draft outline details
Demonstration
GET /orders/{id} with customer B's token for customer A's order must return 404; the test runs in CI.
Check your understanding
Where should the BOLA test live?
Show answer
In the automated suite run by CI.
Practice
Apply this lesson with the module's lab, exercises and quiz.
Marking a lesson complete is optional and you can undo it any time. Your progress stays in this browser.