Please Don't Discard - Security Data
summary
Snowflake persists security reviews as structured files in GitHub — markdown for risk assessments, XML for draw.io DFDs — then converts DFDs into node and edge tables and runs SQL-based STRIDE rules to auto-generate threats. An RTMP-style flow gives about 80% of applicable threats from just a DFD, NLP and LLMs reduce ambiguity by answering yes/no prompts (can this node execute code) and flag compute or network abuse, mitigations become Gherkin test cases, and the system finds and corrects real DFD errors (3 cases) and works in production.
AI-written summary · about
chapters (11)
- 0:00Introduction and speakers
- 1:48Security review program challenges
- 4:17Storing security review data in GitHub
- 6:20Stride per element approach
- 7:23Rapid threat modeling prototyping
- 10:32Threat modeling with directed graphs
- 13:25Answering abuse threat questions
- 17:02Developer perspective on threat modeling
- 23:06Identifying abuse threats with LRIT
- 25:23Surprising insights from the project
- 28:10Q&A and closing remarks
related talks
42mSecurity Threat Modeling Live from Scratch Session
43mDeveloper Driven Security In High-Growth Environments
22mEmpowering Developers through Threat Modeling Excellence
43mThreat modeling
42mThreat Detection across all environments with SnowflakeData Security Lake
17mStrengthening Security and Compliance in Our Data Platform
20mDataEngBytes 2023 PER-T1-10 - Matthew Carter
26mYou Too Can Do Threat Modeling