The Appsec Landscape in 2023
External changes will be driving appsec in 2023. It’s time to frame the decisions in front of you.
Shostack + Friends Blog
Posts in category "legislation"
Threat Model Thursday: NIST’s Code Verification Standard
Earlier this week, NIST released a Recommended Minimum Standard for Vendor or Developer Verification of Code. I want to talk about the technical standard overall, the threat modeling component, and the what the standard means now and in the future.
Thoughts on the Executive Order
A new article by Steve Bellovin and myself at Lawfare.
On Monopolies
In a simpler age, Matt Stoller famously lost his job for critiquing Google.
Internet Society Opposition to LAED Act
The Internet Society Open Letter Against Lawful Access to Encrypted Data Act was published this morning.
India's Intermediary Guidelines
I've signed on to Access Now's letter to the Indian Ministry of Electronics and Information Technology, asking the Government of India to withdraw the draft amendments proposed to the Information Technology (Intermediary Guidelines) Rules.
Keeping the Internet Secure
[no description provided]
Threat Model Thursday: Architectural Review and Threat Modeling
[no description provided]