An Agile Approach to Threat Modeling for Securing Open Source Project EdgeX Foundry
summary
EdgeX Foundry applies an agile, per-sprint threat‑modeling process that uses DFDs and attack tables to enumerate threats against dozens of Go microservices, classify severity, and track fixes in the project roadmap. Identified mitigations include an API gateway with JWT and rate limiting to stop spoofing and DoS, vaulting credentials for persistence access, and iterative modeling down to individual components. The approach reduces attack surface and feeds concrete, prioritized security work into releases.
AI-written summary · about
chapters (26)
- 0:00Introduction
- 1:03Tingyu Introduction
- 2:05Agenda
- 3:12Section 1 Introduction
- 3:44Section 2 Introduction
- 4:27Section 2 Motivations
- 5:31Section 3 Architecture
- 6:48How EdgeX Works
- 7:47Agenda for Section 2
- 9:43Open Source Project Security Challenges
- 10:43Strata Model
- 11:37Section 3 Overview
- 12:53When should we start modeling
- 13:54Who can do that
- 14:48Steps for Threat Modeling
- 16:01Security Triangle
- 17:05Classification Model
- 20:20Threat Mitigation
- 21:36Threat Modeling
- 24:44Mitigation
- 25:27Dark Side
- 26:43Conclusion
- 27:15Reference
- 27:33QA Session
- 33:56Deployment Scope
- 37:24Working Group
related talks
38mIterative Threat Modelling: Security in Agile Development
43mThreat modeling
01h 00mThreat Modeling for Secure Software Design
30mAgile Threat Modeling with Open-Source Tools
37mSecuring Open Source Through Threat Modeling
57mUnlocking Threat Modeling
26mYou Too Can Do Threat Modeling
39mValue driven threat modelling - security by design