What Could Possibly Go Wrong? Plain Language Threat Modeling in DevSecOps
summary
Shows how to capture threat information in plain-language within user stories to unblock DevSecOps processes, using a lifecycle flow that removes security gates and embeds threat data across build, deploy and run phases. Recommends shifting from predicting attacker behavior to identifying critical assets and defenses, and presents that concrete approach as an alternative to gate-based security checks.
AI-written summary · about
chapters (8)
- 0:00Start
- 14:27What is Threat Modeling?
- 20:58A culture of finding and fixing design issues...
- 24:28A journey of understanding...
- 26:36Doing threat modeling...
- 28:59Continuous refinement...
- 46:38Takeaways
- 47:06Applying this to your organization
related talks
22mEmpowering Developers through Threat Modeling Excellence
39mValue driven threat modelling - security by design
29mA Threat Modeling Process can Help you Transition from DevOps to DevSecOps
43mThreat modeling
35mValue Driven Threat Modeling
01h 00mThreat Modeling for Secure Software Design
53mThreat Modeling: uncover vulnerabilities without looking at code
57mUnlocking Threat Modeling