A Threat Modeling Process can Help you Transition from DevOps to DevSecOps
summary
Argues that running focused STRIDE threat-modeling workshops (2–3 hours, every 3–6 months) moves teams from DevOps toward DevSecOps by producing concrete backlog items, updated architecture/flow diagrams and GDPR-ready evidence. Uses a Bastion host example to show attacker-focused questions (authentication, SSH key rotation, tunnels, audit logs, HA for DDoS, privilege escalation). Recommends the STRIDE checklist and Microsoft’s Elevation of Privilege card game as facilitation tools; outcomes are actionable mitigations and better team alignment.
AI-written summary · about
chapters (13)
- 0:00Introduction and speaker intro
- 2:12DevOps vs DevSecOps differences
- 8:32Evolving roles in DevOps teams
- 10:01Threat modeling basics
- 12:31STRIDE method explained
- 14:21Threat modeling workshop setup
- 17:57STRIDE applied to Bastion host
- 21:27Privacy and data exposure risks
- 22:59Denial of service considerations
- 24:03Elevation of privilege risks
- 24:46Security games and tools
- 26:11Benefits of threat modeling
- 27:13Team alignment and compliance
related talks
42mFrom Devops to DevSecOps
22mEmpowering Developers through Threat Modeling Excellence
53mThreat Modeling: uncover vulnerabilities without looking at code
29mRedefining Threat Modeling: Security team goes on vacation
39mValue driven threat modelling - security by design
57mWhat Could Possibly Go Wrong? Plain Language Threat Modeling in DevSecOps
35mValue Driven Threat Modeling
49mThreat Modeling Panel