Threat Modeling With Architectural Risk Patterns
summary
Software-centric method uses risk patterns to speed and scale threat modeling, moving from checklist templates to a flexible rules engine that auto-selects and composes patterns. Claims a practical tradeoff: fast 50% coverage for many apps, deeper manual analysis for the rest. Cites surprising industry stats (85% do security review, 37% do threat modeling, 28% include security team). Shows a working toolchain including IriusRisk and open-source BDD-Security, plus OOP-style inheritance/overloading for maintainable pattern libraries.
AI-written summary · about
chapters (27)
- 0:00Introduction
- 0:54Who does threat modeling
- 1:29Why not threat modeling
- 1:48AppSec 6 study
- 2:29DevOps
- 3:58Threat Modeling
- 5:21The Easy Stuff
- 7:35Conscious Compromise
- 8:06Template
- 8:49OSVS
- 10:15Risk Rating
- 11:24Problems
- 12:32Components
- 13:30Users Perspective
- 15:08Threat Models
- 15:41countermeasures
- 17:15Authentication
- 19:17Generic Patterns
- 25:37SSH Service
- 26:05Building a Library
- 27:25Inheritance System
- 29:54Two Problems
- 30:33Solutions
- 32:20Rules Engine
- 34:27Shortcut
- 36:18Advantages
- 43:28SD Elements
related talks
57mUnlocking Threat Modeling
58mThreat Modeling In And For Your Organization
53mThreat Modeling: uncover vulnerabilities without looking at code
01h 00mThreat Modeling for Secure Software Design
46mThreat modeling is on the rise
43mThreat modeling
52mLessons From The Threat Modeling Trenches
39mValue driven threat modelling - security by design