You Are Not an Island - Threat Model as a Team
summary
Covers a five-stage threat model with practical steps: choose and scope a model, identify threats, prioritize mitigations, document communications, and validate outcomes. Uses the May 2017 WannaCry case study (300,000 machines across 150 countries, NHS impact ~£92M) to show specific team actions — analysts diagram flows, engineers isolate and patch, architects reverse malware, ops coordinate restorations, PR and legal manage stakeholders. Highlights STRIDE, DREAD and the diamond model, and emerging tooling like PY-TMs and Threat Modeling Dragon for automation and reproducible models.
AI-written summary · about
chapters (23)
- 0:00RSAConference 2023
- 1:22Disclaimer
- 1:52Islands Can be Beautiful...
- 2:52Let's Explore How to Help Ray the Castaway
- 7:42How Do We Build The Team?
- 8:36Who is on your Team?
- 9:59Choices
- 11:16Decision Matrix
- 13:26How would a team approach Wannacry?
- 14:53Proactive Approach
- 24:00STRIDE Threat Model
- 24:47Reactive Approach
- 26:35Diamond Model
- 28:04Automating Threat Models
- 31:05Threat Model Steps
- 34:06Create the Model
- 35:13Identify the Threats as a Team
- 35:56Address the Threat
- 37:09Documentation Leads to Communication
- 39:06Validate the Model
- 40:35Each Step as a Team
- 41:11Apply What You Have Learned Today
- 41:58Resources
related talks
53mThreat Modeling: uncover vulnerabilities without looking at code
43mThreat modeling
01h 00mThreat Modeling for Secure Software Design
58mThreat Modeling In And For Your Organization
49mThreat Modeling Panel
46mThreat modeling is on the rise
52mLessons From The Threat Modeling Trenches
44mImproving Cyber Risk Management with Threat Modeling