Threat Modeling Made Interactive
summary
An interactive threat‑modeling tool named Poirot models components and APIs, uses an extensible threat library and compiles system plus requirements into logical constraints solved by a constraint solver to generate exhaustive attack scenarios. The demo builds a tiny web store, finds real issues (parameter guessing and a session collision that allowed account access), and after model edits Poirot rechecks and finds new vectors. The tool is applied to several commercial web apps, uncovers design flaws that lead to fixes, and targets an October release.
AI-written summary · about
chapters (9)
- 0:00Introduction to threat modeling
- 0:52Defining threat modeling
- 3:16Why threat modeling matters
- 6:01Challenges in manual modeling
- 9:06Introducing the Portal tool
- 10:21Demonstrating Portal
- 30:43How Portal works
- 33:23Research context and limitations
- 36:17Related work and future plans
