Designing Security And Privacy: A Dev's Guide To Threat Modeling With OWASP SAMM
summary
A capability catalog for threat modeling is mapped to OWASP SAMM with level‑1, 2 and 3 assignments and a nine‑capability minimum viable program for small Agile teams, backed by a shared Drawbox folder and Playbook links; recommendations list free tools (ThreatDragon, Microsoft tool), defect tracking (DefectDojo) and commercial options, note LLMs for threat idea generation, and report that the mappings and MVP are practical and already in use.
AI-written summary · about
chapters (8)
- 0:00Introduction to threat modeling
- 2:33Threat modeling and OWASP SAMM
- 5:39Developing threat capabilities
- 9:14Mapping capabilities to SAMM
- 21:38Building a roadmap
- 23:54Minimum viable program
- 26:33Conclusion and next steps
- 29:07Questions and answers
related talks
33mIntroduction to OWASP SAMM for Software Developers: Building Secure Software
01h 00mThreat Modeling for Secure Software Design
58mThreat Modeling In And For Your Organization
43mThreat modeling
53mThreat Modeling: uncover vulnerabilities without looking at code
22mEmpowering Developers through Threat Modeling Excellence
46mOWASP SAMM2: Your Dynamic Software Security Journey
51mApplication Threat Modeling Implementation Tips and Tricks