25 Years of Appsec - Appsec Global
Adam is delivering the opening keynote for OWASP Global Appsec 2021 with a 25 year restrospective on the history of appsec and a look into its future.
Shostack + Friends Blog
Posts in category “information security”
NIST Brings Threat Modeling into the Spotlight
New at Darkreading, a post on NIST and threat modeling
Threat Model Thursday: NIST’s Code Verification Standard
Earlier this week, NIST released a Recommended Minimum Standard for Vendor or Developer Verification of Code. I want to talk about the technical standard overall, the threat modeling component, and the what the standard means now and in the future.
Apple Guidance on Intimate Partner Surveillance
Apple has released ‘Device and Data Access when Personal Safety is At Risk’ and I wanted to explore it a bit.
This time for sure, Pinky!
If everyone agrees on what we should do, why do we seem incapable of doing it?
IoT Security & Threat Modeling
Expanding on the UK Government's ‘The Uk Code of Practice for Consumer IoT Security’ and how it aligns with Threat Modeling.
It's 2021: Have you checked your backups?
As the expression goes, no one cares about backups, they care about restores. Do yours work?
Encryption & Privacy Policy and Technology
A few tidbits in recent news.
Empirical Evaluation of Secure Development Processes
Earlier this year, I helped to organize a workshop at Schloss Dagstuhl on Empirical Evaluation of Secure Development Processes. I think the workshop was a tremendous success.
A Seat At The Table (AppSecCali)
My talks from AppSecCali 2019
Pivots and Payloads
A new game from SANS for understanding pen test methodology, tactics, and tools.
House Oversight Committee on Equifax
The House Oversight Committee has released a scathing report on Equifax...
CVE Funding and Process
[no description provided]
Doing Science with Near Misses
Near misses are an important source of information for avoiding accidents, and it's a shame we don't use them in cybersecurity.
Learning from Near Misses
[no description provided]
20 Year Software: Engineering and Updates
[no description provided]
It's Not The Crime, It's The Coverup or the Chaos
[no description provided]