25 Years in AppSec: Looking Back
Time flies and things change... A look back on the growth of this industry.
Shostack + Friends Blog
The COVID testbed and AI
The pandemic gives us a chance to evaluate AI tools...you'll be shocked to discover how they did.
Zen and the art of not quantifying risk
Many people want their threat modeling work to produce risk numbers, and in this post you'll learn why that's a mistake.
Threat Model Thursday: NIST’s Code Verification Standard
Earlier this week, NIST released a Recommended Minimum Standard for Vendor or Developer Verification of Code. I want to talk about the technical standard overall, the threat modeling component, and the what the standard means now and in the future.
Collaboration in Threat Modeling
It's the latest in the World's Shortest Threat Modeling videos!
Sketching to Answer 'What are we working on?'
The latest in the World's Shortest Threat Modeling Videos.
Threat Model Thursday: 5G Infrastructure
The US Government's lead cybersecurity agencies have released an interesting report, and I wanted to use this for a Threat Model Thursday, where we take a respectful look at threat modeling work products to see what we can learn.
Applied Threat Modeling at BlackHat 2021
At Blackhat USA, I'll be teaching Applied Threat Modeling.
Why Threat Model?
The second video in my 60 second series!
Juneteenth: A New Federal Holiday
Thoughts on the new federal holiday, Juneteenth
Fast threat modeling videos
I'm exploring the concept of very fast threat modeling videos.
'Not in my threat model'?
You know what's not in my threat model? A meteor hitting a volcano... And that's ok!
Ransomware is Not the Problem
Arbitrarily powerful software -- applications, operating systems -- is a problem, as is preventing it from running on enterprise systems.
Thoughts on the Executive Order
A new article by Steve Bellovin and myself at Lawfare.
Van Buren
The Supreme Court has ruled in the van Buren case, and there's a good summary on the Eff's blog.