(Ab)user Experience: The Dark side of Product and Security
summary
Practical steps to design security into products: turn giant, abstract security NFR lists into small, testable abuser stories that developers will pick up; run quick workshops with abuser personas (PNG) and misuse cases to map how real people might weaponize features; expand key misuse cases into lightweight attack trees to enumerate concrete exploits, costs and mitigations. Embed these artifacts into sprint planning, link them to acceptance criteria, and measure progress so security becomes part of product delivery rather than a gated add‑on.
AI-written summary · about
chapters (21)
- 0:00Welcome
- 1:08Security policies enforcement
- 3:16Cyber crime human element
- 5:43Compromising positions podcast
- 7:05Security as opportunity
- 9:13Strongest defense people
- 10:38Shifting left product security
- 12:22Product vs application security
- 15:28Agile security teams
- 17:38Thinking like hackers
- 21:30Dark side UX
- 23:35Threat modeling simplified
- 26:44Persona misuse cases
- 30:18NFRs to abuser stories
- 33:28Threat modeling questions
- 36:39Integrating security agile
- 41:58Tooling iterative security
- 43:22Security culture starts
- 46:30Building security culture
- 53:11Key takeaways
- 54:57Security innovation
related talks
37m(Ab)User Experience.
18mDesigning for Security Outcomes
33mLearning from Past Security Breaches: Strengthening AppSec Efforts and Focus
27mBridging the Dev-Sec divide: Three tips for agile developers
40mMaking Security an integrated part of the SW Dev Lifecycle
48mHow to build a security mindset
01h 04mShifting Security Everywhere
22mThe Hip Approach to Safeguarding your Users