Nature and Nurture in Threat Modeling
What comes easily should still be taught and elaborated upon.
Shostack + Friends Blog
Fire Doesn't Innovate by Kip Boyle (Bok Review)
An unexpected book review.
Incentives and Multifactor Authentication
It's well known that adoption rates for multi-factor authentication are poor. For example, "Over 90 percent of Gmail users still don’t use two-factor authentication."
Threat Modeling: Attackers May Adapt, Respond
Reasons for failure in real-world security
Threat Modeling as Code
Omer Levi Hevroni has a very interesting post exploring ways to represent threat models as code.
LinkedIn Learning: Producing a Video
My Linkedin Learning course is getting really strong positive feedback. Today, I want to peel back the cover a bit, and talk about how it came to be.
IriusRisk 2.0
I’m excited to be able to share “Announcement: IriusRisk Threat Modeling Platform 2.0 Released.”
Scaling Threat Modeling Training
For the last few years, I've been delivering in-person threat modeling training. I've trained groups ranging from 2 to 100 people at a time, and I've done classes as short as a few hours and as long as a week.
Change in the Weather
Some recent changes in the weather...
Threat Model Thursday: Talking, Dialogue and Review
As we head into RSA, I want to hold the technical TM Thursday post, and talk about how we talk to others in our organizations about particular threat models, and how we frame those conversations.
Doing Science with Near Misses
Near misses are an important source of information for avoiding accidents, and it's a shame we don't use them in cybersecurity.
Modeling Attackers and Their Motives
There are a number of reports out recently, breathlessly presenting their analysis of one threatening group of baddies or another. Most readers should, at most, skim their analysis of the perpetrators. Read on for why.