Using IAC to Accelerate Threat Modeling
summary
Claim is that using infrastructure as code speeds threat modeling by importing templates and auto-generating results. The demo uses CloudFormation and Terraform input, parses them into an IrisRisk model and diagramming (draw io / OTM) via API, auto-creates threat items and two‑way synced tickets to Jira/Azure DevOps, and shows time dropping from days to hours. The pipeline builds diagrams, lists specific threats and countermeasures, issues tracked and closed, and the demo works end to end.
AI-written summary · about
chapters (23)
- 0:00Introduction
- 1:11Session overview
- 2:54What is Infrastructure as Code
- 4:38Threat modeling
- 7:32Automated threat modeling benefits
- 8:54Linking IaC with threat modeling
- 11:01Three-step threat modeling process
- 12:26Live demo
- 12:47Building threat model in Iris Risk
- 17:27Importing CloudFormation scripts
- 19:38Automating threat detection with APIs
- 21:23Generating remediation tickets
- 22:48Updating threat models
- 24:32Tracking threat mitigation
- 26:42Open Threat Model customization
- 27:44Portfolio risk analysis
- 29:11Summary
- 30:16Q&A: Time savings
- 32:23Q&A: Scanning IaC misconfigs
- 33:26Q&A: Shared security responsibility
- 36:16Q&A: Outsourcing threat modeling
- 37:17Q&A: Cloud scanning tools
- 39:00Closing
related talks
47mAutomating Architectural Risk Analysis with the Open Threat Model format
30mAgile Threat Modeling with Open-Source Tools
34mThreat Model-as-Code
50mThreat Modeling With Architectural Risk Patterns
46mThreat modeling is on the rise
37mPaved Roads To Express RBAC In Threat Models
42mSecurity Threat Modeling Live from Scratch Session
33mSecurity scans for terraform templates