Securing Open Source Through Threat Modeling
summary
Claim: systematic threat modeling uncovers real, fixable flaws in open source — the team uses manual code review, fuzzing and automated scanning to find bugs in Harbor and NATS, and correlates findings with internet-wide scans. They show supply‑chain risk from outdated libraries (example: almost a quarter million servers still vulnerable after a public OpenSSL disclosure). Recommended workflow pairs automated scanning + manual review with clear objectives and timeboxed analysis.
AI-written summary · about
chapters (25)
- 0:00Introduction
- 1:08Agenda
- 2:17What is Threat Modeling
- 3:45Why should we do Threat Modeling
- 5:14Threat Modeling 101
- 7:02Threat Modeling in the Beginning
- 10:10Advanced Threat Modeling
- 11:23Known vs unknown vulnerabilities
- 12:22Setting clear objectives
- 14:56Understanding how the application works
- 16:58What can go wrong
- 17:35CWE
- 18:57OSS Top 10
- 20:02Stride
- 21:04Verification
- 22:01Supply Chain Attacks
- 22:29What is Supply Chain Attack
- 23:56Outdated Libraries
- 25:43You are not the target
- 26:46OpenSSL
- 27:36Informationally
- 29:01Legacy code
- 30:22Automatic tools
- 34:00Problems with security products
- 35:18Summary
related talks
35mOpen source security: Opportunity or oxymoron?
52mCollaborating to Improve Open Source Security: How the Ecosystem Is Stepping Up
29mSecuring the Unseen: Defending Against Open Source Software Supply Chain Attacks
11mKeynote: Securing Open Source
32mIs the Internet on Fire? Strategies for Mitigating Open Source...
54mSupply Chain Security for OpenSource Projects
18mIT Security – Don’t let Open Source Software become the next menace
18mSecuring InnerSource