Using Threat Modeling to Improve Compliance

on YouTube ↗40m

" summary

Claim: mapping PCI line items to explicit threats reveals PCI emphasizes process and management threats (outdated firewall rules, retained auth data, missing logs) as much as technical exploits. Method: build data flow diagrams, apply STRIDE to produce system and process models, then map each threat to specific PCI requirements. Outputs: a PCI threat model, a white paper, and a suggested rollout: use the Elevation of Privilege card game and the four-question framework to prioritize current changes, reduce audit friction, and align controls to real threats.

AI-written summary · about

" chapters (31)

1. 0:00Intro
2. 0:42The Elevator Version
3. 2:03Understanding Compliance
4. 3:12Payment Card Industry Data Security Standard ("PCI")
5. 4:42Delving into PCI
6. 5:55PCI-DSS Version 3.2
7. 6:12Randomly chosen page of PCI
8. 7:17A Software Engineer's Day (Ideal)
9. 7:34A Software Engineer's Day (take 2)
10. 8:13A Software Engineer's View
11. 9:16Compliance Creates Conflict (1/2)
12. 11:07Compliance Causes Conflict (2/2)
13. 12:40Threat Modeling, Threat Intel
14. 13:54The Four Question Framework for Threat Modeling
15. 15:15STRIDE Mnemonic
16. 16:04The Triangle Model of Threats & Requirements
17. 18:10Applying Threat Modeling
18. 19:29Methodology (3)
19. 22:25PCI's Process Model
20. 23:32PCI's System Model
21. 25:22Threats to Technology
22. 26:41PCI's Threat Model is Easily Misunderstood (Revisiting)
23. 28:40Improve Security By Corporate Threat Modeling
24. 29:38Making the World Better: Corporate Version
25. 30:23Reduce Corporate Conflict With Threat Modeling
26. 31:07More Threat Modeling, More Collaboration
27. 32:19Making the World Better: Standards Version
28. 33:15Can We Make Better Standards?
29. 34:05Short Term Wins
30. 34:55Learn Threat Modeling
31. 36:17Resources

" related talks

• 57mUnlocking Threat ModelingBrook S.E. Schoenfield · OWASP AppSec California 2016
• 43mThreat modelingErlend Oftedal · NDC TechTown 2017
• 53mThreat Modeling: uncover vulnerabilities without looking at codeChris Romeo · NDC TechTown 2018
• 22mEmpowering Developers through Threat Modeling ExcellenceMunzur Rahman · DevWorld 2024
• 31mReverse Engineering ComplianceAdam Shostack · Black Hat Asia 2021
• 49mThreat Modeling PanelAdam Shostack, Izar Tarandach, Brook S.E. Schoenfield, Jonathan Marcil, Haral Tsitsivas · OWASP AppSec California 2018
• 46mThreat modeling is on the riseEmil Kvarnhammar · Øredev 2022
• 01h 00mThreat Modeling for Secure Software DesignRobert Hurlbut · CodeMash 2018