Nature and Nurture in Threat Modeling
What comes easily should still be taught and elaborated upon.
Shostack + Friends Blog
Fire Doesn't Innovate by Kip Boyle (Book Review)
An unexpected book review.
Incentives and Multifactor Authentication
What if we gamified security?
Threat Modeling: Attackers May Adapt, Respond
Reasons for failure in real-world security
Threat Modeling as Code
Exploring threat models as code.
LinkedIn Learning: Producing a Video
My Linkedin Learning course is getting really strong positive feedback. Today, I want to peel back the cover a bit, and talk about how it came to be.
IriusRisk 2.0
I’m excited to be able to share “Announcement: IriusRisk Threat Modeling Platform 2.0 Released.”
Scaling Threat Modeling Training
For the last few years, I've been delivering in-person threat modeling training. I've trained groups ranging from 2 to 100 people at a time, and I've done classes as short as a few hours and as long as a week.
Beyond Elf on a Shelf
Happy Holidays!
High ROI Security Advisory Boards
Discussing the value of Security Advisory Boards
Pivots and Payloads
A new game from SANS for understanding pen test methodology, tactics, and tools.
Resources for Infosec Skillbuilding
The Threat Modeling Book has been featured on a list of resources by Digital Guardian.
House Oversight Committee on Equifax
The House Oversight Committee has released a scathing report on Equifax...
Structures, Engineering and Security
J.E. Gordon’s Structures, or Why Things Don’t Fall Down is a fascinating and accessible book. Why don’t things fall down? It turns out this is a simple question with some very deep answers.
Gavelblocken, 2018
The Gavle Goat is up.