Shostack + Friends Blog

Posts in category “product management”

AI and Business Strategy

How can we shape a business strategy in an ‘AI world?’ (30 Jul 2026)

 

A Tale of Two Addresses

Output encoding is a tool, not a hammer. Or maybe it's a hammer. (07 Oct 2024)

 

Tracking Company Says 96% of iPhone Users Block Tracking

So there's some good news and some bad news in this story: 'Too Bad, Zuck: Just 4% of U.S. iPhone Users Let Apps Track Them After iOS Update'. (08 May 2021)

 

Medical Device Threat Modeling

New training being developed, seeking interest. (26 Mar 2020)

 

Amazon's 'Alexa Built-in' Threat Model

Exploring supply chain threat modeling with Alexa (05 Mar 2020)

 

 

Medical Device Security Standards

Recently, I've seen four cybersecurity approaches for medical devices, and we can learn by juxtaposing them. (02 Nov 2019)

 

 

Interesting Reads, August 19

Just what the title says (21 Aug 2019)

 

Safety and Security in Automated Driving

Let’s explore the risks associated with Automated Driving. (08 Jul 2019)

 

 

The Road to Mediocrity

The road to mediocre writing is paved with over-simplification and distraction. (05 Jul 2019)

 

 

Passwords Advice

Bruse Marshall has put together a useful comparison of password requirements from OWASP ASVS v3 and v4. (26 Jun 2019)

 

The White Box Essays (Book Review)

A resource for those developing games. (10 Apr 2019)

 

 

Leave Those Numbers for April 1st

Over-inflated numbers won't scare me into buying your ‘solution’. (02 Apr 2019)

 

 

Incentives and Multifactor Authentication

What if we gamified security? (01 Feb 2019)

 

Threat Model Thursday: Architectural Review and Threat Modeling

[no description provided] (21 Jun 2018)

 

 

The DREAD Pirates

[no description provided] (31 May 2018)

 

Joining the Continuum Team

[no description provided] (15 May 2018)

 

 

Not Bugs, but Features

[no description provided] (05 Jan 2018)

 

 

The Fights We Have to Fight: Fixing Bugs

[no description provided] (08 Nov 2017)

 

 

Why is 'Reply' Not the Strongest Signal?

[no description provided] (02 Nov 2017)

 

20 Year Software: Engineering and Updates

[no description provided] (23 Oct 2017)

 

 

The Dope Cycle and a Deep Breath

[no description provided] (21 Jul 2017)

 

 

Threat Modeling Password Managers

[no description provided] (17 Jul 2017)

 

Secure updates: A threat model

[no description provided] (10 Jul 2017)

 

Bicycling and Threat Modeling

[no description provided] (06 Jun 2017)

 

The Ultimate Stopping Machine?

[no description provided] (30 May 2017)

 

Threat Modeling & IoT

[no description provided] (01 May 2017)

 

How Not to Design an Error Message

[no description provided] (20 Apr 2017)

 

 

2017 and Tidal Forces

[no description provided] (13 Jan 2017)

 

The Dope Cycle and the Two Minutes Hate

[no description provided] (04 Jan 2017)