Practical Threat Modeling for real-world and Cloud Situations in our hybrid and W...
summary
Covers a concrete five‑step threat‑modeling workflow: Create, Identify, Address, Validate, Communicate, and claims to be directly applicable to hybrid/WFH cloud setups. Demonstrates methodologies STRIDE, PASTA, Diamond, shows hands‑on examples with OWASP Top Ten using DVWA and a VPC, and walks through an AWS billing app architecture (S3 + Lambda + RDS) with practical mitigations like file‑size checks, MFA and least privilege. Includes gamified exercises and validation suggestions (pen tests, metrics). Worth watching for anyone who needs actionable cloud threat modeling rather than theory.
AI-written summary · about
chapters (18)
- 0:00Introduction
- 0:45Who am I
- 2:25About Uma
- 4:24What is Threat Modeling
- 10:39Why Threat Modeling
- 14:10How and Engaging
- 16:46Threat Models
- 25:17Diamond Threat Model
- 28:26Big Picture
- 30:41Identifying Threats
- 32:27Documentation
- 33:00Communication
- 33:35Validation
- 34:26Mitigations
- 35:09Acceptance Criteria
- 37:47Application Architecture
- 45:29Document
- 49:39Validate
related talks
40mCloud Threat Modeling - from Architecture Design to Application Development
32mIntro to Threat Modeling in the Cloud
53mThreat Modeling: uncover vulnerabilities without looking at code
46mThreat modeling is on the rise
58mThreat Modeling In And For Your Organization
01h 00mThreat Modeling for Secure Software Design
43mThreat modeling
22mEmpowering Developers through Threat Modeling Excellence