Threat Modeling: uncover vulnerabilities without looking at code - Chris Romeo

Threat modeling is an approach for analyzing the security of an application. Threat modeling is a learned security skill where developers find security issues and mitigate the problems before writing a single line of code. Threat modeling consists of drawing a simple data flow diagram, analyzing the design for security threats using STRIDE, and mitigation of any found issues. The Instructor surveys available threat modeling tools that participants could use within their organizations to perform threat modeling.
This session begins with a short lecture covering the basics of threat modeling and the steps for successful threat modeling. Participants perform threat modeling on whiteboards in small teams for the majority of the session. At the conclusion, participants share their findings.
NDC Conferences
ndctechtown.com
ndcconferences...

[@zainab6140]

great presentation and content 👍 thank you!

[@yungesqargo1493]

Java example: you said authentication - Great answer(s)... Code review is also good solution- Thanks 💸

[@berndeckenfels]

It’s a repeating loop even If you not change the project. New attacks and techniques become known and on each iteration you can go deeper and be more creative or stricter. An iteration does not guarantee you are proofen secure/complete.

[@nmkkannan1256]

No Auth, No cryptography storage, PCI data is process as a plain text.

[@chrisadams27]

"Not an elite force" Classic!!

[@ntobopascalineefeh4531]

Great explanation. Can you help sir. I am stuck in on threat modeling homework.