Improve your threat modelling through the science of simplicity
summary
Presents a four‑property simplicity framework (cheap, value, predictable/reliable, composable) and applies it to threat modelling, claiming the result reduces cost and noise and increases adoption at a startup with a couple hundred developers. Builds an open source process and tool called threatware that uses Google Docs/Confluence input, validates documents, converts them to JSON/YAML in git, stores approved versions, emits aggregated, fewer threats, links actions to ticketing, and reports it works for microservice environments but struggles with large monoliths.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 3:18Defining simplicity
- 6:19The science of simplicity
- 12:24Framework for threat modeling
- 23:51Applying the framework
- 37:59Evaluating common approaches
- 41:34Case study: Threatware
- 54:52Conclusion and Q&A
related talks
01h 00mThreat Modeling for Secure Software Design
49mThreat Modeling Panel
58mThreat Modeling In And For Your Organization
21mA tool to help improve your threat modeling
39mValue driven threat modelling - security by design
35mValue Driven Threat Modeling
52mLessons From The Threat Modeling Trenches
57mIntroducing Threat Modelling To Established Teams