Is Cybersecurity Awareness Month Worth the Money?
How can we measure the ROI on an awareness month?
Shostack + Friends Blog
Recent Blog Posts, Page 12
Car Safety Factoids
A few thoughts from a clickbait headline
Purple States
The United States is less divided than common maps portray.
Why do we call them trust boundaries?
Why do we call them trust boundaries, anyway?
Election Prediction
Adam's election prediction and request.
Patching in 2024
In late 2024, people are being offered a choice of features versus security.
The Economy
Trump’s cornerstone economic policy is bad for America and the world.
Appsec Roundup - Oct 2024
If you say liability three times, it appears!
On policy
I wish this election were about policy
Russia
Some thoughts on Russia and the election
25 Years of CVE
Some thoughts on 25 years of the CVE program
Scaling Threat Modeling
Our newest course: Scaling Threat Modeling
The people who served under Trump
I’ve posted about democracy, and about country before party. Those were principled posts about things that could be said about any election, but rarely needed saying. Today, I’m going to post about one of the candidates, Donald Trump, in a way that has never been said in my lifetime, and that is many people who served under him now say he’s unfit to be President, and they say that repeatedly and in public.
MITRE ATT&CK: Threat Model Thursday
Threat model Thursday, let's dive deep into a detailed approach to using ATT&CK
OWASP Board 2024
Time to vote for OWASP leadership