Intro to Threat Modeling in the Cloud
summary
Threat modeling for cloud systems focuses on concrete practices: use the egregious 11 to prioritize likely cloud risks (data breaches, misconfiguration, missing cloud security strategy), run a component threat model like the Argo CD threat model (Trail of Bits did Argo in 2021 and produced a risk table), document a simple minimal service documentation (five–six questions + architecture diagram), invite architects, support, QA and tech writers, assign scribe and facilitator, and automate boilerplate with PR templates and jq/yq parsing so conversations target the top risks.
AI-written summary · about
chapters (11)
- 0:00Threat modeling intro
- 1:25Why environment matters
- 2:50Structured threat modeling
- 5:16Who to invite
- 7:45Cloud shared responsibility
- 8:49Top 3 cloud threats
- 12:00Data breach lessons
- 16:20Good threat model report
- 19:26Step-by-step guide
- 24:10Continuous threat modeling
- 27:18Q&A
related talks
40mCloud Threat Modeling - from Architecture Design to Application Development
53mPractical Threat Modeling for real-world and Cloud Situations in our hybrid and W...
46mThreat modeling is on the rise
43mThreat modeling
44mImproving Cyber Risk Management with Threat Modeling
01h 00mThreat Modeling for Secure Software Design
58mThreat Modeling In And For Your Organization
57mUnlocking Threat Modeling