Fixing Threat Models with OWASP Efforts
summary
Enterprises run on broken threat models: a federal SCAP/Oval rollout never fully adopted across ~1,000,000 nodes and a commercial insurer loses ~$650,000/hour to Conficker show tool‑first failures. The remedy is concrete: use PASTA risk‑centric threat modeling (including a PASTA simulation prototype ~90% complete), map evidence‑based threats into attack trees, and operationalize OWASP projects—Juice Shop, ZAP, ASVS, Testing Guide and ModSecurity rules—to convert threat intel into prioritized, monetized impact and repeatable mitigations.
AI-written summary · about
chapters (18)
- 0:00Introduction
- 5:26Risk Dilemmas
- 8:17Threat Modeling Process
- 11:08IOT
- 13:34Context
- 14:10Common denominator
- 18:42Threat model stories
- 19:50Funneling context
- 20:23Threat landscape
- 21:13Missing deliverables
- 22:26Roles
- 24:40Integration
- 26:11Projects
- 27:21blinding threat modeling
- 29:10Cisco Project
- 33:53Web Testing Framework
- 35:34Model Security Rule
- 36:28Besom
related talks
57mUnlocking Threat Modeling
52mLessons From The Threat Modeling Trenches
01h 00mThreat Modeling for Secure Software Design
50mThreat Modeling With Architectural Risk Patterns
44mOWASP Based Threat Modelling: Creating A Feedback Model In An Agile Environment
43mThreat modeling
29mThreat Modelling 101
38mIterative Threat Modelling: Security in Agile Development