Shostack + Friends Blog

Posts in category "threat model thursday"

MITRE ATT&CK: Threat Model Thursday

Threat model Thursday, let's dive deep into a detailed approach to using ATT&CK (17 Oct 2024)

The Universal Cloud TM -- Threat Model Thursday

A new universal threat model - what can we learn from it? (06 Jun 2024)

A diagram showing a camera, storage, photoshop and validation. The camera and photoshop are in boundaries

C2PA Threat Modeling

What can we learn from the C2PA security considerations document? (29 Nov 2023)

Threat Modeling Thursday: Thanksgiving

What can we learn from Gunnar Peterson’s Threat Model for Thanksgiving? (23 Nov 2023)

A diagram showing threats such as prompt injection and model theft that are threats to a ML tool

Five Threat Model Diagrams for Machine Learning

Some diagrams to help clarify machine learning threats (13 Apr 2023)

A set of cards with threats like our deployment artifacts contain secrets that can be extracted

Cumulus

Cumulus is a cloud-oriented version of Elevation of Privilege (06 Apr 2023)

Threat Modeling Google Cloud (Threat Model Thursday)

NCC has released a threat model for Google Cloud Platform. What can it teach us? (01 Mar 2023)

Threat Modeling is Measure Twice, Cut Once

Threat Modeling is the software version of measure twice, cut once. (12 Jan 2023)

Threat Model Thursday: curl

Looking at a threat model for curl, the command line web client. (29 Dec 2022)

screenshot from NIST website referencing Executive Order 14028

Threat Model Thursday: NIST’s Code Verification Standard

Earlier this week, NIST released a Recommended Minimum Standard for Vendor or Developer Verification of Code. I want to talk about the technical standard overall, the threat modeling component, and the what the standard means now and in the future. (15 Jul 2021)

Threat Model Thursday: 5G Infrastructure

The US Government's lead cybersecurity agencies have released an interesting report, and I wanted to use this for a Threat Model Thursday, where we take a respectful look at threat modeling work products to see what we can learn. (01 Jul 2021)

Fast threat modeling videos

I'm exploring the concept of very fast threat modeling videos. (17 Jun 2021)

One of the slides from Adam's RSA presentation

Using Threat Modeling to Improve Compliance (TM Thursday)

Threat model Thursday is not just back, but live again! (20 May 2021)

person creating smoke with handheld device

Threat Model Thursday: Technology Consumers

“It depends on your threat model...” (29 Apr 2021)

IoT Security & Threat Modeling

Expanding on the UK Government's ‘The Uk Code of Practice for Consumer IoT Security’ and how it aligns with Threat Modeling. (22 Apr 2021)

Threat Model Thursday: Github's Approach

A bunch of people recently asked me about Robert Reichel’s post 'How We Threat Model,' and I wanted to use it to pick up on Threat Model Thursdays. (16 Apr 2021)

Threat Model In My Devops

A recent talk by Alyssa Miller focuses on integrating threat modeling in devops. (02 Jul 2020)

boy holding model airplane with shadow cast upon a boulder

Models and Accuracy (Threat Modeling Thursday)

For Threat Model Thursday, I want to look at models and modeling in a tremendously high-stakes space: COVID models. (14 May 2020)

Threat Model Thursday: Data Flow Diagrams

This week's threat model Thursday looks at an academic paper, Security Threat Modeling: Are Data Flow Diagrams Enough? by Laurens Sion and colleagues. (23 Apr 2020)

Power Dynamics in Threat Modeling

On Linkedin, Peter Dowdall had a very important response to my post on remote threat modeling. (02 Apr 2020)

Threat Modeling with Questionnaires

This post comes from a conversation I had on Linkedin with Clint Gibler. (19 Mar 2020)

amazon alexa units wearing dark glasses and black fedoras

Amazon's 'Alexa Built-in' Threat Model

Exploring supply chain threat modeling with Alexa (05 Mar 2020)

Threat Model Thursday: BIML Machine Learning Risk Framework

Risk Framework and Machine Learning (27 Feb 2020)

Threat Model Thursday: Games

For reasons I can't quite talk about yet, this has been a super busy time, and I look forward to sharing the exciting developments that have kept me occupied. (06 Feb 2020)

graphic of magnifying glass in front of 3 filled and expanded file folders

Threat Model Thursday: Files

Have you considered the idea that “Files are Fraught With Peril” lately? Maybe you should... (23 Jan 2020)

Threat Modeling Thursday: The Human Element

I joined Caroline Wong on the Humans of Infosec Podcast to discuss The Human Element of Threat Modeling. (09 Jan 2020)

Threat Modeling Thursday: Machine Learning

For my first blog post of 2020, I want to look at threat modeling machine learning systems. (02 Jan 2020)

close view of brightly-colored frosted cupcakes

Managed Attribution Threat Modeling

Let's talk CAKED, a threat model for managed attribution. (14 Nov 2019)

Includes No Dirt: Healthcare Threat Modeling (Thursday)

“Includes No Dirt” is a threat modeling approach by William Dogherty and Patrick Curry of Omada Health, and I've been meaning to write about it since it came out. (31 Oct 2019)

Testing Building Blocks

There are a couple of new, short (4-page), interesting papers from a team at KU Leuven discussin the building blocks of threat modeling. (07 May 2019)