FAIR STRIDE - Building Business Relevant Threat Models
summary
Combines STRIDE threat lists with FAIR risk math and Monte Carlo simulations to turn findings into dollars, 90% confidence intervals and log‑normal loss distributions. Builds a spreadsheet model (three months to seed at a mid‑size company), simulates thousands of years, produces loss‑exceedance curves and exact probabilities (example: 7.7% chance to lose $500k reduced to 2% after controls). Lets teams compare fixes — semgrep rules versus support FAQs — by measured change in expected annual loss.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 1:06Background and motivation
- 4:17Threat modeling with STRIDE
- 8:08Limitations of CVSS scoring
- 9:54FAIR risk framework overview
- 15:33Monte Carlo simulations explained
- 18:46Demo setup and spreadsheet walkthrough
- 27:17Interpreting loss exceedance curves
- 33:44TL;DR and program improvements
- 37:56Q&A session
related talks
22mUsing Cyber Data To Financially Quantify Cyber Risk Decisions
22mEmpowering Developers through Threat Modeling Excellence
40mForecasting Threats is Way Easier Than You Think
53mThreat Modeling: uncover vulnerabilities without looking at code
45mThe Business Value of Security
44mImproving Cyber Risk Management with Threat Modeling
52mBetting the Farm on Digital Disruption
57mUnlocking Threat Modeling