Handling Pandemic-Scale Cyber Threats: Lessons from COVID-19
Emerging research on Cyber Public Health
Shostack + Friends Blog
Posts in category “research papers”
Lessons for Cybersecurity from the American Public Health System
An important step towards cyber public health
Who Are 'We?' Power Centers in Threat Modeling
I had planned to start 2025 with a more positive note, but the loss of Amit Yoran, who was only a few years older than me, has hit me hard. I first met Amit at a Computers, Freedom and Privacy conference in the early 90s. He was in his West Point uniform, which was not typical for attendees of the conference. So I went over and struck up a conversation, and we continued over probably 30 years. I miss him. His memorial service will be on Jan 8, in Fairfax, VA. [Link, date updated.]
Insecurity of Government Infrastructure
We have a new paper at NDSS
Threat Model Thursday: Technology Consumers
“It depends on your threat model...”
Mitigating Social Bias in Knowledge Graphs
Something to consider
Contextualisation of Data Flow Diagrams...
Contextualisation of Data Flow Diagrams for security analysis is a new paper to which I contributed.
'Best Practices for IoT Security'
There's an interesting new draft, Best Practices for IoT Security: What Does That Even Mean? by Christopher Bellman and Paul C. van Oorschot.
SDL Article in CACM
Most of my time, I'm helping organizations develop the skills and discipline to build security in. We give the best advice available, and I recognize that we're early in developing the science around how to build an SDL that works.
Threat Model Thursday: Data Flow Diagrams
This week's threat model Thursday looks at an academic paper, Security Threat Modeling: Are Data Flow Diagrams Enough? by Laurens Sion and colleagues.
Empirical Evaluation of Secure Development Processes
Earlier this year, I helped to organize a workshop at Schloss Dagstuhl on Empirical Evaluation of Secure Development Processes. I think the workshop was a tremendous success.
Valuing CyberSecurity Research Datasets
A paper at the Workshop on the Economics of Information Security titled “Valuing CyberSecurity Research Datasets” focuses on the value of the IMPACT data sharing platform at DHS, and how the availability of data shapes research.
Safety and Security in Automated Driving
Let’s explore the risks associated with Automated Driving.
Polymorphic Warnings On My Mind
The more we see it, the more we ignore it.
Measuring ROI for DMARC
I'm pleased to be able to share work that Shostack + Associates and the Cyentia Institute have been doing for the Global Cyber Alliance.
Learning from Near Misses
[no description provided]
“Comparing the Usability of Cryptographic APIs”
[no description provided]
Adam & Chris Wysopal webcast
[no description provided]
“...the Elusive Goal of Security as a Scientific Pursuit”
[no description provided]
Cyber Grand Shellphish
[no description provided]
Cyber Balance Sheet
[no description provided]
Calls for an NTSB?
[no description provided]