Secure and Privacy by Design Converge with Threat Modeling
summary
Argues that secure and private by design needs concrete choices not slogans, and shows a repeatable workflow: pick a memory-safe language and modern framework (he uses Go and React), build a data flow diagram, apply reusable patterns (authentication via AWS Cognito and MFA, ABAC, validation, TLS, secure logging), use tools like Govulncheck and Gosec plus SBOMs, run STRIDE-LM threat modeling, and track 0/1 implementation and mitigations on a SupeCar example.
AI-written summary · about
chapters (23)
- 0:00Introduction and context
- 2:01Defining the core concepts
- 5:01Customer needs vs expectations
- 6:14Core tenants of security
- 7:18Overlooked implementation gaps
- 8:20Critique of current guidance
- 9:07Assessing industry frameworks
- 11:44Bridging the implementation gap
- 12:14Proposed solution framework
- 13:47Supercar case study overview
- 14:30Seven key design decisions
- 22:39Applying design decisions
- 25:33Architecture and trust
- 26:37Defining security patterns
- 27:42Base patterns for security
- 28:12Authentication and authorization
- 29:00Operational security patterns
- 37:24Threat modeling integration
- 38:03Threat source and mitigation
- 39:48Supercar threat assessment
- 40:26Measuring success
- 41:44Conclusion and call to action
- 43:30Q&A session
related talks
43mSecurity By Design
18mDesigning for Security Outcomes
51mSecure Applications, By Design
01h 00mThreat Modeling for Secure Software Design
01h 02mSo long secure coding... Hello secure development!
34mSecure by design - the secret weapon of high-performing organisations
27mSecurity by Design
22mEmpowering Developers through Threat Modeling Excellence