Breaking into threat modeling
A video interview by OWASP leader Vandana Verma, on the topic of breaking into threat modeling.
Shostack + Friends Blog
Trainings at Global Appsec 2021
Tremendous training opportunities in threat modeling and other topics at Appsec Global 2021
What are we going to do: CO2 edition
What happened when Microsoft tried to buy climate abatements
Lessons Learned: Playing Elevation of Privilege
We learn while we're having fun. Some takeaways from a recent play to learn session.
NIST Brings Threat Modeling into the Spotlight
New at Darkreading, a post on NIST and threat modeling
A Vulnerable System
Andrew Stewart has an excellent new book, A Vulnerable System.
What can go wrong?
The World's Shortest Threat Modeling Video series continues with .. what can go wrong?
Training discounts!
Are you tired of escalations and fights after pen tests find crucial security issues at the last minute? I have a discount code for upcoming threat modeling training that can help!
This is the blog you're looking for
Making it easier to check feed updates
Threat Modeling Through the JoHari Window
Let me call your attention to a new post by Irene Michlin, “Where Threat Modelling fits in the matrix?” (with a few comments on why it matters).
Training - October
Are you tired of escalations and fights after pen tests find crucial security issues at the last minute? I have upcoming threat modeling training that can help!
25 Years in AppSec: Looking Back
Time flies and things change... A look back on the growth of this industry.
The COVID testbed and AI
The pandemic gives us a chance to evaluate AI tools...you'll be shocked to discover how they did.
Zen and the art of not quantifying risk
Many people want their threat modeling work to produce risk numbers, and in this post you'll learn why that's a mistake.
Threat Model Thursday: NIST’s Code Verification Standard
Earlier this week, NIST released a Recommended Minimum Standard for Vendor or Developer Verification of Code. I want to talk about the technical standard overall, the threat modeling component, and the what the standard means now and in the future.