The Joy of Threat Landscaping
summary
Argues that a threat landscape is a living concept to standardize threat language across an org, not a one-off report; recommends starting with stakeholder mapping and interviews, then intelligence requirements, collection, analysis and iterative dissemination. Shows a successful one-page brief (designed to be cut out and left on an executive’s desk), warns that automated tools can gather data but cannot replace tailored analysis, notes pitfalls like bloated MITRE ATT&CK table, non-English source translation, and using confidence language and visuals (timelines, flow and relationship diagrams) to drive decisions.
AI-written summary · about
chapters (22)
- 0:00Intro
- 2:59What am I going to talk about?
- 3:32Public sector vs private sector applications
- 5:15What is a threat landscape
- 6:10Three (main) types of threat landscapes
- 8:43Understanding needs
- 10:55Why a threat landscape
- 12:49Applying the process
- 13:23Understanding your stakeholders
- 14:20Soliciting (intelligence) requirements
- 15:07Designing the deliverable
- 16:50Collection & processing
- 18:45Analysis & producing the deliverable
- 20:37Feedback, or a word on improving
- 21:54Choosing the right format
- 23:33Take your time designing your product
- 25:22Successful uses of visualizations
- 27:44Using assessments in your threat landscape
- 28:43Considering your audience
- 29:17GJ's 'Bottom-Line-Up-Front' Pyramid
- 30:09Example product (summary page)
- 31:09Do's and don'ts
related talks
49mThreat Modeling Panel
58mThreat Modeling In And For Your Organization
37mThreats versus Capabilities Building Better Detect and Respond Capabilities
52mLessons From The Threat Modeling Trenches
57mUnlocking Threat Modeling
57mIntroducing Threat Modelling To Established Teams
01h 00mLayered Threat Modeling: An Architectural Approach
57mWhat Could Possibly Go Wrong? Plain Language Threat Modeling in DevSecOps