(Ab)User Experience.
summary
A practical pitch to fold security into product work: start threat modeling at the product/design stage, not just in appsec; convert abstract security NFRs into abuser stories and put them on the backlog; run workshops that use persona non grata, misuse cases and attack trees to find exploitable flows; expect outcomes like fewer late fixes, decentralized risk acceptance in agile teams, and evidence that lip service costs (ICO fined a company 4.4 million after a phishing-led breach) while global losses may hit 10.5 trillion by 2025.
AI-written summary · about
chapters (7)
- 0:00Introduction to abuser experience
- 3:07Security as a product value
- 7:07Shifting left in product security
- 15:54Team roles in product security
- 23:38Security requirements as user stories
- 28:50Building a security culture
- 34:03Key takeaways and conclusion
related talks
57m(Ab)user Experience: The Dark side of Product and Security
18mDesigning for Security Outcomes
48mHow to build a security mindset
22mThe Hip Approach to Safeguarding your Users
31mPrioritizing Trust while Creating Applications
38mPrioritizing Trust While Creating Applications
27mBridging the Dev-Sec divide: Three tips for agile developers
33mLearning from Past Security Breaches: Strengthening AppSec Efforts and Focus