Threat Modeling With Good Questions and Without Checklists - Farshad Abasi - ASW #335
17 June - 1 hour 8 minsWhat makes a threat modeling process effective? Do you need a long list of threat actors? Do you need a long list of terms? What about a short list like STRIDE? Has an effective process ever come out of a list? Farshad Abasi joins our discussion as we explain why the answer to most of those questions is No and describe the kinds of approaches that are more conducive to useful threat models.
Resources:
https://www.eurekadevsecops.com/agile-devops-and-the-threat-modeling-disconnect-bridging-the-gap-with-developer-insights/ https://www.threatmodelingmanifesto.org https://kellyshortridge.com/blog/posts/security-decision-trees-with-graphviz/ In the news, learning from outage postmortems,...
Series Episodes
Astro Oblivion, FreePBX, GitHub, OWASP, Promptlock, Claude Aaran Leyland - SWN #507
35 mins
29 August Finished
Hackers Steal Your Car and Vulnerabilities - Rob Allen - PSW #889
2 hours 10 mins
28 August Finished
Naughty RBG, Docker, RDP, SBOMS, Kullback-Leibler, Oneflip, Youtube, Josh Marpet... - SWN #506
33 mins
26 August Finished
Translating Security Regulations into Secure Projects - Roman Zhukov, Emily Fox - ASW #345
1 hour 13 mins
26 August Finished
Oktane Preview with Harish Peri, Invisible Prompt Attacks, and the weekly news! - Harish Peri - ESW #421
1 hour 49 mins
25 August Finished
