Recently active topics
So I know the usual suspects, of course: @Adam Shostack's books, various YouTube channels (including from IriusRisk), the Threat Modelling Manifesto, and this forum..But let's say I want to become an "expert" in Threat Modelling… what can you recommend? Something on LinkedIn Learning, perhaps? Or by O'Reilly? Or is it simply a matter of getting up-to-speed on the primary literature and hands-on learning?
In the threat modelling methodology I use, I ask teams to capture the authentication and authorization methods that the different parts of their system implement (for those bits in-scope). This ask, as it turns out, has been something that teams have really struggled with. It seems to be a combination of not always having the difference between authn and authz very clear in their mind, and the fact that sometimes the difference is indeed not very clear at all anyway! (IP allow-lists is a good example - authn or authz? or it depends?).In an effort to at least bring some consistency in how the teams I work with capture authn and authz, I created some Examples and some Guidance to help them, which I thought I would share, in case it helps others as well.If you know of any authn/z guidance, examples or docs that might help others, please do share.
I remember the first conference where I ever spoke about threat modeling like it was yesterday. The conference was the Microsoft Secure Development Lifecycle conference in Washington, DC, and the year was around 2010. I did a panel with a few other folks on threat modeling under the more significant SDL conference context. I always wished for a conference focused on threat modeling, and now that wish has come true! I am acting as the first conference chair for Threat Modeling Conference. A few of us in the world of threat modeling got together as founding members of Threat Modeling Connect. During an initial conversation, I mentioned that a big-ticket goal of Connect should be to host a threat modeling conference. And my reward for that suggestion was an invitation to chair the event. Always be careful when making suggestions. Of course, I'm kidding and honored to chair this event. I'm working with my various threat modeling besties, like Izar Tarandach @izar , Matt Coles, Brook Scho
What approach does everyone use to get developers engaged in the threat modeling process? Have you found that developers are generally open to getting involved and see the value in shifting left or do they look at it like its just going to add additional work for their teams?
It’s easy for everyone in security to agree on doing extra work to create secure systems. In my experience, it seems that once we begin to socialize or implement the process/idea/system/etc. there is pushback from others. Threat modeling is no exception.Implementing change, even if it is for the good, is difficult. Has anyone engaged with pushback to threat modeling? Either as a security practice or specific details in the methodology?If so, I’d love to hear your thoughts on how the pushback was approached. Or, like my kids would say, how did you clapback??
Hello, hola, hallo, guten tag, bonjour, shalom…community!One of the most exciting parts of your journey in Threat Modeling Connect is the opportunity to meet and work closely with the best and brightest (and kindest!) threat modeling professionals around the world. Let’s greet each other and share:Where you work, live, and your current role Your threat modeling experience, challenges, expertise - whether you’re just beginning or further down the journey, we’d love to hear more of your story Where we can find you if you’re not threat modelingWe’ll get to know each other more along the way. This is just the beginning of something great :)
(as seen in The Security Table’s first LinkedIn live podcast episode!)As much as system builders at large have been more willing to accept Threat Modeling as a useful practice with clear positive results and advantages, it is still somewhat difficult to institute it as a part of the secure software development lifecycle in most organizations.The reasons are many, but chiefly among them is the clear fact that eliciting threats out of a design requires a certain amount of expertise, experience and savviness that is hard to quantify and harder to teach, in security practitioners. We can train people to be aware of security weaknesses that may be introduced at the design stage, but it is harder to train them to identify the multiple ways these weaknesses can sneak in when a system is being designed, or implemented in an agile way, when the design couples tightly with the implementation.This author (and many others!) has tried to make that path shorter, with Continuous Threat Modeling (http
One question I am often asked by the many organizations I work with is where do I begin ? How do I get started Threat Modeling? What do I Threat Model, and what do I need to be concerned with? As with everything you do, you must be willing to take the first step. Taking on a new challenge is often very intimidating and the fear of failure is real. My advice is to start with the smallest, most simple application or workflow you have. Keep your model small and specific to a singular process. If you identify 1 new threat today, then you have accomplished something significant. I also encourage people to not take this task on by themselves. Threat Modeling is a collaborative process. No one know everything, so leverage the knowledge of your teams. And because you have kept your model compartmentalised, your collaborators will not feel overwhelmed. Finally, I highly encourage people to move the process of Threat Modeling left. By this I mean, start the process very early in the software de
We, the ThreatModCon 2023 Programme Committee were stunned by the response to our Call For Papers. It’s a new conference, the first conference dedicated to threat models and threat modelling. So the committee members would have been happy to receive a few more papers than available speaking slots.But that’s not what’s happened! Given an embarrassment of riches, we decided to add a second (2nd) presentation and workshop track. Then the hard task of choosing began.I wonder if those who’ve not been on a conference committee are familiar with the process:Understand every submission Adopt a process for identifying each evaluator’s favourites Urge (nag?) evaluators to make choices Categorize submissions by theme for an interesting mix Wrangle evaluators into 1, usually more meetings to work through disagreements and issues Draft acceptance and rejection letters. Obtain approval from committee Notify submitters Schedule the talks in some manner as to keep the energy flowing and themes coheren
🔔 Stay connected
Start a conversation
Validate your ideas, share resources, get feedback from your peers and experts.Make a post
Create your account
Not a member yet? Become a member to join forum discussions, participate in community events and apply to write articles.Create an account
Log in with LinkedIn
Enter your username or e-mail address. We'll send you an e-mail with instructions to reset your password.