Defenses: Swiss Cheese (Threat Model Thursday)
A “Swiss cheese model” of defenses helps engineers organize defenses and think broadly.
Shostack + Friends Blog
Posts in category “books”
Defenses for Developers (Threat Model Thursday)
Defenses are often confusing, and developers make the security choices that are hard to reverse. But if you can handle git, you can handle threat modeling.
Threats and LLMs (Threat Model Thursday)
There are many ways to ask what can go wrong, and the useful skill is knowing which one matches what you're building.
Diagrams versus Models (Threat Model Thursday)
What does the new book tell us about the difference between diagrams and models?
Diagrams and Common Elements (Threat Model Thursday)
All diagrams should have common elements, and using them consistently is a mark of skill and maturity
Diagram Style (Threat Model Thursday)
What makes a diagram good or useful?
Save on Threat Modeling 2nd Edition
Barnes & Noble is having a preorder sale. Save on Adam's new book, coming February 2027!
Diagrams and Clarity (Threat Model Thursday)
Diagrams serve needs, and surprisingly, form follows function
Boundaries, Not Trust Boundaries (Threat Model Thursday)
Boundaries are a crucial topic in the new threat modeling book
Why threat modeling is the technique that survives AI disruption
AI is disrupting software security, but traditional threat modeling remains the ultimate survival skill.
Threat Modeling: A Second Edition
The long-awaited second edition of Threat Modeling...
AI Insurance Won't Save You
LLM Insurance is, and will remain, a great source of insurer profits.
CVE Futures
What’s next for the CVE program?
Free Threats
Pray they don’t alter the price any further
The Covid pandemic, 5 years on
Thinking about Covid, five years on.
Human Centered Security
An exciting new book on human-centered security.
Worthwhile Books 1H 2024
Books that I've read that are worth your time
97 Things Every Application Security Professional Should Know
Proud to be an O’Reilly author!
William Anders
Commemorating William Anders
Happy Star Wars Day
When Obi-Wan sends Luke to Degobah for training, Yoda tries everything he can to reject him. Now, we have to acknowledge that Yoda’s suffering from PTSD, having failed to prevent the overthrow of the Republic, the murder of all the students, and really, frankly, Obi-Wan’s incredibly bad judgement about apprentices. And Yoda’s final excuse is “He is too old! Yes, too old to begin the training.”
Conoscere Il Lato Oscuro
Threats is available in Italian!
Threat Modeling Thursday: Thanksgiving
What can we learn from Gunnar Peterson’s Threat Model for Thanksgiving?
Security Principles in 2023
Principles are lovely, but do they lead us to actionable results?
No guns please
Art imitating life in ways you didn’t think possible
Worthwhile Books Q2 2023
Books that I read in the second quater that are worth your time include two memoirs, a great book on the security of ML, and more!
Reflecting on Threats: The Frame
Reflecting on the framing of the Threats book
My David Prouse Moment
Searching my feelings as the audiobook of Threats is released.
Not all developers can be Jedi
Adam joined Paul Roberts on the Conversing Labs podcast
Threats, To The Supply Chain
The threats book is in the supply chain, inconsistently.
Threats Book Launch Party
The live launch party for Threats!
Threats Book is Complete
The serious side of the book
Threats: The Table of Contents
Like the Force, each threat has a light side, and a dark side.
Worthwhile Books Q4 2022
Books that I read in the fourth quater that are worth your time include several about safety with lessons for cybersecurity
Worthwhile Books Q3 2022
The books I read in the third quarter of 2022 that are worth your time.
on the security of Star Wars
Adam joined Josh and Kurt on the Open Source Security podcast
Worthwhile Books May 2022
These are the books that I read in the second quarter, 2022 that are worth your time.
CyberPeace
A new book on cyberpeace!
Worthwhile Books Q1 2022
These are the books that I read in the second half of 2021 that I think are worth your time.
Digital Guru Books
Rupin Gupta runs Digital Guru books. He's one of the nicest people you'll ever meet, a real joy to work with, and he works hard to put books on shelves so that you can discover them. With the conference business changing, Digital Guru needs some help.
Worthwhile Books Q2 2020
These are the books that I read in Q2 2020 that I think are worth your time.
Bounce and Range
I want to talk about two books: Bounce, by Matthew Syed and Range, by David Epstein. I want to talk about them together in part because Range is explicitly framed as a response to Bounce.
Worthwhile Books (Q1 2020)
These are the books I read in the first quarter (and forgot to mention last quarter) that I think are worth your time.
Books Worth Your Time (Q4)
Just what the title says...
Books Worth Reading: Q2 2019 (Apollo Edition)
Some books worth reading, particularly related to space and history
Books Worth Your Time (Q1 2019)
Just what the title says...
Fire Doesn't Innovate by Kip Boyle (Book Review)
An unexpected book review.
Books which are worth your time: Q4
Some books worth reading.
Reflective Practice and Threat Modeling (Threat Model Thursday)
[no description provided]
Security Engineering: Computers versus Bridges
[no description provided]
45 Years
[no description provided]
Worthwhile Books, Q3
Some of what I've read over the past quarter and want to recommend as worthy of your time.
Humble Bundle
[no description provided]
Worthwhile Books: Q2 2017
I'm always looking for interesting books to read. These are the books that I enjoyed enough to recommend in Q2.