Threat modeling is on the rise
summary
Claim: doing collaborative threat modeling with C4 diagrams uncovers concrete risks and workable fixes. Example findings include server-side request forgery from unvalidated parameters, denial of service by stuffing carts until a database fills, cloud databases accidentally exposed, CI/CD credential risk mitigated by OIDC for GitHub, and a historical exploitation where an admin framework IPC write allowed root file creation by bypassing an Objective C auth check. Tools used: diagrams, threat libraries, logging/monitoring, and gap analysis with penetration tests.
AI-written summary · about
chapters (16)
- 0:00Intro
- 0:21My background
- 1:51Digital transformation - Everywhere
- 3:55Autonomous team needs
- 5:51Threat modeling intro
- 7:37Team members or Security Specialists?
- 10:26What are we building?
- 19:10What can go wrong?
- 27:33Identifying threats
- 31:31Countermeasures
- 33:03Did we do a good job?
- 33:30Verification strategies
- 36:26Threat model for systemsetup
- 41:05Threat modeling summarized
- 42:01The future of threat modeling?
- 43:04Use Threat Models to augment...
related talks
43mThreat modeling
01h 00mThreat Modeling for Secure Software Design
57mUnlocking Threat Modeling
58mThreat Modeling In And For Your Organization
53mThreat Modeling: uncover vulnerabilities without looking at code
49mThreat Modeling Panel
40mCloud Threat Modeling - from Architecture Design to Application Development
49mThreat Modeling Toolkit