OWASP Based Threat Modelling: Creating A Feedback Model In An Agile Environment
summary
Claims a practical PSC (policy standards controls) approach that maps InfoSec policy to 13 reusable standards and per-flow controls (e g limit sign‑in attempts CSP subresource integrity require node 10.15), demonstrates it on a library-login DFD, and adds an existing‑risk column that upgrades residual findings across sprints. A complementary tool called Threat Surfing batches and prioritizes thousands of requests, pulls CI/CD/pen test feedback into a ticketing feed, and produces dashboards (browser issues shown rising from 5% to 18% in sample data); code is slated for open source.
AI-written summary · about
chapters (15)
- 0:00Intro
- 0:19Agenda
- 2:59Some of the commonly used frameworks
- 4:49Relevance
- 7:32Building blocks
- 15:14Process
- 16:00Sample Use Case
- 16:21Requirement Gathering and Onboarding
- 24:43Balancing the Risk
- 26:29The missing piece
- 28:23Threat Surfing Architecture
- 30:52Onboarding new application
- 31:26Baselining the threat landscape
- 33:15Benefits
- 34:25Key Takeaways
related talks
43mThreat modeling
57mUnlocking Threat Modeling
38mIterative Threat Modelling: Security in Agile Development
22mEmpowering Developers through Threat Modeling Excellence
50mThreat Modeling With Architectural Risk Patterns
43mFixing Threat Models with OWASP Efforts
39mValue driven threat modelling - security by design
01h 00mThreat Modeling for Secure Software Design