Threat Modeling Toolkit
summary
Uses a minimalist connection flow diagram that focuses on attack surface, plus attack trees via PlantUML to organize real attacker goals; applies both to a cryptocurrency example (electron wallet, exchange, mobile app). Demonstrates finding a JSON‑RPC/local daemon vulnerability and DNS‑rebinding path to remote API access, maps mitigations into a compact seven‑item security checklist, and shows the models improve communication and catch real issues.
AI-written summary · about
chapters (36)
- 0:00Introduction
- 0:27Background
- 1:35Threat Modeling Experience
- 2:32What is Threat Modeling
- 2:53Train Intelligence
- 3:17Why do Threat Modeling
- 4:28Lack of Communication
- 4:55Communication
- 5:19Tools
- 5:46DFG Diagram
- 7:13Not an architectural document
- 8:08Flow diagram
- 9:09Mobile app
- 9:27Electron Wallet
- 10:45Blockchain Integration
- 12:18Extended Set
- 13:03Domain Real Life
- 13:30Graph
- 14:35Labels
- 15:00Errors
- 15:22Target Visuals
- 15:47JSONRPC Vulnerability
- 16:17Note
- 17:10Security Control Checklist
- 18:45Questions
- 27:22Architecture
- 27:59Attack Tree
- 35:34Spy
- 35:52Privacy
- 38:49Balance
- 39:15WebEx
- 40:01Whiteboard
- 40:33Plans UML
- 45:14Parse
- 46:00Conclusion
- 48:20Modeling Panels
related talks
43mThreat modeling
01h 00mThreat Modeling for Secure Software Design
53mThreat Modeling: uncover vulnerabilities without looking at code
46mThreat modeling is on the rise
57mUnlocking Threat Modeling
29mThreat Modelling 101
22mEmpowering Developers through Threat Modeling Excellence
51mApplication Threat Modeling Implementation Tips and Tricks