Software Security Initiative Capabilities - Where do I begin?
summary
Compares three SSI entry points—penetration testing, static code analysis, and threat modeling—and gives concrete tradeoffs: mature tools for pen testing and SCA require heavy customization to be useful, people bring inconsistent but creative finds, and no tool automatically produces a threat model. Notes Visio and Microsoft Threat Modeling Tool as actual artifacts, warns about cost and scaling (free to six‑figure), and claims each method finds different classes of defects so a mix is necessary for real coverage.
AI-written summary · about
chapters (9)
- 0:00Fundamentals of pen testing
- 1:45Tools and people in testing
- 5:13Secure code review practices
- 8:20Secure design and modeling
- 13:04Tooling for design reviews
- 17:44Collaborative security design
- 22:11Practical threat modeling
- 26:48Human versus tool effectiveness
- 30:55Integration and conclusion
related talks
53mWhat is a software security initiative and do I need one?
43mDesigning Security And Privacy: A Dev's Guide To Threat Modeling With OWASP SAMM
26mSimple Guide to Secure SDLC
38mFree security resources that your competitors use!
53mThreat Modeling: uncover vulnerabilities without looking at code
45mLeveraging Projects and Tools to Transform Your SDLC
33mBattle Tested Application Security
44mSecurity Practices Useful in Agile Development