Threat Modelling: Star Wars Edition
summary
Explains how threat modeling finds concrete failures not metaphors: builds a DFD of the Death Star, applies STRIDE + DFDs + SDL and frameworks (MCSB, MITRE ATT&CK, OWASP Top 10, AI LLM Top 10), and traces the actual exploit — a 2 m thermal exhaust port leading to catastrophic reactor loss — noting the Death Star cost estimate (852 quadrillion USD) and 20 year build time. Offers mitigations (eliminate port, harden controls, logging, least privilege), recommends checking models into repos and doing models by hand. Death Star thermal exhaust port exploit
AI-written summary · about
chapters (17)
- 0:00Threat modeling intro
- 2:06What is threat modeling
- 4:35Defense in depth basics
- 6:18Microsoft SDL basics
- 9:48Security mindset for threat modeling
- 11:33Adversarial threat modeling
- 13:38Threat modeling fundamentals
- 17:05Identifying threats with STRIDE
- 20:53Mitigation strategies
- 21:54Verify phase and continuous
- 23:42Death Star intro
- 26:51Death Star data flow
- 27:33Death Star threats
- 29:23Thermal exhaust port fix
- 30:06STRIDE with Death Star
- 35:23Death Star lessons
- 36:07Resources and closing
related talks
29mThreat Modeling the Death Star
43mThreat modeling
01h 00mThreat Modeling for Secure Software Design
53mThreat Modeling: uncover vulnerabilities without looking at code
38mThreat Modelling Kubernetes: A Lightspeed Introduction
22mEmpowering Developers through Threat Modeling Excellence
52mLessons From The Threat Modeling Trenches
46mThreat modeling is on the rise