The Architect's Guide to Fortifying Software Security
summary
Visualization shows data breaches from 2004 to Sept 2022 and counts billions of exposed records, so architecture focuses on concrete defenses: layered perimeter/network/endpoint controls plus application-level TLS and authentication. Architects produce an application diagram, identify data flows and assets, run STRIDE-based threat modeling, prioritize threats and deliver a traceability matrix of risks and countermeasures. Recommendations specify use of Microsoft SDL tool, OWASP/Top25 references, encryption algorithms and key lengths, MFA, SAST/vulnerability scanning (used >10 years) and incident/change procedures.
AI-written summary · about
chapters (6)
- 0:00Architect's security role
- 3:36Secure design principles
- 9:18Threat modeling basics
- 13:32Threat modeling steps
- 21:43Security controls guidance
- 24:54Incident response plans
related talks
40mTool Time: Building Your Cybersecurity Architecture Planning Toolbox
45mSecurity Architecture, An Adventure?
32mThe Art of Secure Architecture
57mThe Developer's Field Guide to Software Security
50mMoving Security Architecture from Art to Engineering
01h 17mSecure by Design - Security Principles for the Working Architect
51mSecure Applications, By Design
33mLearning from Past Security Breaches: Strengthening AppSec Efforts and Focus