OWASP Keynote Available for Viewing!
Watch Adam's keynote 'Stop Trying to 'Manage Risk'' From OWASP 2025
Shostack + Friends Blog
Posts in category “compliance”
The Cyber Resilience Act (CRA)!
The CRA is coming and it's going to be a dramatic change for technology producers
Security Researcher Comments on HIPAA Security Rule
A group of us have urged HHS to require better handling of security reports
Healthcare Info Security: Podcast Episode with Marianne Kolbasuk McGee
Adam on Healthcare Info Security podcast
The Appsec Landscape in 2023
External changes will be driving appsec in 2023. It’s time to frame the decisions in front of you.
How Executives Can Use Threat Modeling
You don’t have to be technical, but you can’t make informed decisions about your business without threat modeling.
NIST Brings Threat Modeling into the Spotlight
New at Darkreading, a post on NIST and threat modeling
Using Threat Modeling to Improve Compliance (TM Thursday)
Threat model Thursday is not just back, but live again!
A PCI Threat Model
Compliance isn't Security, oh and something I wrote.
3 Arguments for Threat Modeling
Top 3, from Continuum
Incentives and Multifactor Authentication
What if we gamified security?
Microsoft's PCI Blueprint
[no description provided]