Iterative Threat Modelling: Security in Agile Development
summary
Uses OWASP Juice Shop as a live guinea pig and claims iterative threat modeling fits into agile sprints with a 60‑minute workshop (or a 15‑minute backlog refinement shortcut). Identifies threats with STRIDE, prioritizes with DREAD plus explicit security objectives, and records mitigations as stories, acceptance criteria, spikes or task cards in the project tracker (not spreadsheets). Says this uncovers design flaws that code scans miss and produces concrete, prioritized fixes that teams can implement each iteration for measurable alignment across security, product and engineering.
AI-written summary · about
chapters (33)
- 0:00intro
- 1:43about jags
- 2:25expectations
- 2:55threat modelling
- 3:49misconceptions about tm
- 5:18agile threat modelling
- 8:11owasp juice shop
- 9:26before starting...
- 11:05example: security objective
- 12:12what do we want to accomplish? - scoping
- 13:10example: scoping
- 13:44what are we building? software-centric approach
- 14:44example: data flow diagram
- 15:45what can go wrong? - evil brainstorming
- 16:42methodology. No 'best' way
- 17:23spoofed identity
- 19:50tampering with input
- 20:47repudiation of action
- 21:33information disclosure
- 22:53denial of service
- 23:23elevation of privilege
- 24:09example: applying stride
- 25:07what are we going to do about it? - prioritize
- 26:26example: prioritize
- 28:45mitigation
- 29:51example: mitigation
- 30:41did we do a good job? - reflect...
- 31:50iterative threat modelling ...and repeat
- 33:44ways of running the workshop
- 34:39learn more
- 35:26threat modelling in software development lifecycle
- 36:34what was the mnemonic again?!?!
- 36:44takeaways
related talks
35mValue Driven Threat Modeling
39mValue driven threat modelling - security by design
57mIntroducing Threat Modelling To Established Teams
22mEmpowering Developers through Threat Modeling Excellence
29mRedefining Threat Modeling: Security team goes on vacation
53mThreat Modeling: uncover vulnerabilities without looking at code
01h 00mThe One Where We Threat Model During Development
39mAgilifying Threat Modeling in Development Teams