📙 Level Up Your Threat Modeling: Turning Security Into a Team Adventure 🖥️
summary
A method that gamifies threat modeling into a role‑playing session claims to make developers stick with the process by mapping real systems, playing from a deck of ~24 threat and mitigation cards aligned to STRIDE (examples include gluttonous slime and mimic of trust), scoring threats on a challenge‑rating matrix (damage dice vs saving throw), awarding XP (eg. 8 XP for a critical, easy exploit), tracking leaderboards, running 2‑hour tabletop sessions or remote workshops in Lucid Spark/Miro and exporting actions to spreadsheets for follow‑up.
AI-written summary · about
chapters (12)
- 0:00Introduction and welcome
- 1:48Origin of the D&D threat model
- 5:01Toolkit for the adventure
- 7:51Roles in the threat modeling party
- 9:59Building the system map
- 12:06Monster and mitigation cards
- 14:11Prioritizing threats with XP
- 16:57Applying mitigations and rewards
- 19:05Iterative threat modeling campaigns
- 21:11Recognizing participant efforts
- 23:18Key takeaways and next steps
- 26:49Q&A and closing remarks
related talks
22mEmpowering Developers through Threat Modeling Excellence
29mRedefining Threat Modeling: Security team goes on vacation
58mThreat Modeling In And For Your Organization
35mValue Driven Threat Modeling
49mThreat Modeling Panel
52mLessons From The Threat Modeling Trenches
53mThreat Modeling: uncover vulnerabilities without looking at code
01h 00mThreat Modeling for Secure Software Design