An Exploratory Tester's lessons on Security Threat Modeling
summary
Exploratory testing pairs with threat modeling to produce concrete artifacts: whiteboard data‑flow and sequence diagrams, a STRIDE checklist, and a short task list that often contains claims to verify like HTTP versus HTTPS and configuration fixes rather than full penetration tests. Specific examples include rules ordering in a firewall (deny before allow claimed) and adding logging or unit‑test checks; teams run one‑hour sessions, read CVEs, try small scans, and sometimes use tools like Mitton for Selenium extensions to validate outcomes.
AI-written summary · about
chapters (23)
- 0:00Introduction
- 1:25Maarets perspective
- 3:34What am I
- 4:53The tester identity
- 5:40The agile team
- 9:10The future
- 11:17Illusions
- 12:04External Imagination
- 16:08No Product Owner
- 16:57Security Threat Modeling
- 18:12Data Flow Diagram
- 20:56Stride
- 27:45Combining threat modeling and expiratory testing
- 28:02Drawing on a whiteboard
- 29:40Pay attention to security
- 31:42Breaking illusions
- 32:30Team dynamics
- 34:53Patience
- 35:40Serendipity
- 35:59Perseverance
- 36:25Money
- 37:56FSecure
- 39:29Questions
related talks
22mEmpowering Developers through Threat Modeling Excellence
53mThreat Modeling: uncover vulnerabilities without looking at code
01h 00mThreat Modeling for Secure Software Design
43mThreat modeling
57mUnlocking Threat Modeling
29mRedefining Threat Modeling: Security team goes on vacation
52mLessons From The Threat Modeling Trenches
46mThreat modeling is on the rise