'Not in my threat model'?
You know what's not in my threat model? A meteor hitting a volcano... And that's ok!
You know what's not in my threat model? A meteor hitting a volcano... And that's ok! Your threat modeling should be focused on the threats that are likely to impact your systems. So unless your system is your evil supervillain volcano lair, a meteor is likely out of scope. And unless you have giant space lasers, there's not a lot you can do about that meteor.
You'll learn this, and more in my threat modeling courses, and speaking of which, we have some upcoming.
- Applied Threat Modeling, July 31/Aug 1 or August 2/3 at Blackhat. This is our most popular course.
- Threat modeling for security champs, July 19-24. This course is for those with a strong technical base, looking to improve their ability to help others threat model.
You can see our upcoming open courses at courses.shostack.org/, and you can sign up there for course announcements.