Lessons for Cybersecurity from the American Public Health System
An important step towards cyber public health
Shostack + Friends Blog
Posts in category "research papers"
Who Are 'We?' Power Centers in Threat Modeling
Insecurity of Government Infrastructure
We have a new paper at NDSS
Threat Model Thursday: Technology Consumers
“It depends on your threat model...”
Mitigating Social Bias in Knowledge Graphs
Something to consider
Contextualisation of Data Flow Diagrams...
Contextualisation of Data Flow Diagrams for security analysis is a new paper to which I contributed.
'Best Practices for IoT Security'
There's an interesting new draft, Best Practices for IoT Security: What Does That Even Mean? by Christopher Bellman and Paul C. van Oorschot.
SDL Article in CACM
Most of my time, I'm helping organizations develop the skills and discipline to build security in. We give the best advice available, and I recognize that we're early in developing the science around how to build an SDL that works.
Threat Model Thursday: Data Flow Diagrams
This week's threat model Thursday looks at an academic paper, Security Threat Modeling: Are Data Flow Diagrams Enough? by Laurens Sion and colleagues.
Empirical Evaluation of Secure Development Processes
Earlier this year, I helped to organize a workshop at Schloss Dagstuhl on Empirical Evaluation of Secure Development Processes. I think the workshop was a tremendous success.
Valuing CyberSecurity Research Datasets
A paper at the Workshop on the Economics of Information Security titled “Valuing CyberSecurity Research Datasets” focuses on the value of the IMPACT data sharing platform at DHS, and how the availability of data shapes research.
Safety and Security in Automated Driving
Let’s explore the risks associated with Automated Driving.
Polymorphic Warnings On My Mind
The more we see it, the more we ignore it.
Measuring ROI for DMARC
I'm pleased to be able to share work that Shostack + Associates and the Cyentia Institute have been doing for the Global Cyber Alliance.
Learning from Near Misses
[no description provided]
“Comparing the Usability of Cryptographic APIs”
[no description provided]
Adam & Chris Wysopal webcast
[no description provided]
“...the Elusive Goal of Security as a Scientific Pursuit”
[no description provided]
Cyber Grand Shellphish
[no description provided]
Cyber Balance Sheet
[no description provided]
Calls for an NTSB?
[no description provided]