You Too Can Do Threat Modeling
summary
Walks through threat modeling a real help site United for Ukraine: maps architecture with data‑flow diagrams and trust boundaries, applies STRIDE to each subsystem, and records ~30 specific threats in a spreadsheet. Uses private GitHub, Vercel hosting and Zendesk ticket storage as concrete assets; proposes backups, off‑platform backups for Zendesk, two‑factor auth, scoped permissions, and CAPTCHA for automation. Prioritizes mitigations by risk and reports the result as good enough to sleep well.
AI-written summary · about
chapters (9)
- 0:00Introduction to threat modeling
- 2:52What is threat modeling
- 3:56Mock threat modeling demo
- 8:14STRIDE threat categories
- 12:54Threat modeling process summary
- 13:37Meta tips for effective modeling
- 18:33Security competence in organizations
- 21:53Repetition and security work
- 23:18Q&A: Public vs private models
