Unlocking Threat Modeling
summary
Claims threat modeling is architecture-first applied security and gives concrete techniques: draw architectures, mark red attack surfaces (message bus, data sources, identity services), build system-specific threat landscapes (Web Soccer AMA, router vendor Digital Disqus), and harden parsers with input validation. Risk assessment uses a simplified FAIR style and treats exposure factors quickly as binaries to find credible attack vectors, i.e. treat factors as booleans to interrupt exposure and reduce exploitability. Methods are visual, iterative, and designed for rapid, repeatable reviews.
AI-written summary · about
chapters (39)
- 0:00Introduction
- 1:02Show me the money
- 1:25Disclaimer
- 2:36Expectations
- 3:07Participatory
- 4:20Design problem
- 7:14Requirements
- 8:00Mindshare
- 8:50Architecture
- 10:26Threat Modeling
- 10:46Secure Software
- 12:21Security Architecture
- 13:25One hundred percent certainty
- 14:24Context
- 17:01Whats already in place
- 17:24Data sensitivity
- 17:44Top secret
- 18:03No book of answers
- 18:14Architectures
- 18:45Architecture Cold Call
- 22:09Application Server
- 23:03Browser Protection
- 23:25Configuration
- 23:44App
- 23:58Targets
- 24:31Employee Net
- 25:16Message Flow
- 26:11Organization Purpose
- 26:39Access
- 27:05The Architecture
- 30:06Ecommerce
- 30:33Extranet
- 31:55Process
- 33:15Threat Matrix
- 36:49Systems Objectives
- 37:17Risk
- 41:41Business Intelligence
- 45:20Input Validation
- 49:16Identity Services
related talks
53mThreat Modeling: uncover vulnerabilities without looking at code
43mThreat modeling
01h 00mThreat Modeling for Secure Software Design
50mThreat Modeling With Architectural Risk Patterns
46mThreat modeling is on the rise
52mLessons From The Threat Modeling Trenches
51mApplication Threat Modeling Implementation Tips and Tricks
58mThreat Modeling In And For Your Organization