Shostack + Friends Blog

Check out “The Need for Evidence Based Security” by Chris Frenz. (04 Jun 2020)

I generally try to stay on technical topics, because my understanding is that's what readers want. But events are overwhelming and I believe that not speaking out is now a political choice. (03 Jun 2020)

As I built out my home studio to record videos for my distributed classes, I was lucky enough to be able to find an in-stock HDMI capture card, but those are harder and harder to find. As it turns out, you may be able to avoid the need for that with a mix of apps. (28 May 2020)

Phil Bull presents an interesting, generally convincing, argument in 'Why you can ignore reviews of scientific code by commercial software developers', with a couple of exceptions. (26 May 2020)

Understanding the way intrusions really happen is a long-standing interest of mine. (20 May 2020)

For Threat Model Thursday, I want to look at models and modeling in a tremendously high-stakes space: COVID models. (14 May 2020)

Most of my time, I'm helping organizations develop the skills and discipline to build security in. We give the best advice available, and I recognize that we're early in developing the science around how to build an SDL that works. (11 May 2020)

I want to talk about two books: Bounce, by Matthew Syed and Range, by David Epstein. I want to talk about them together in part because Range is explicitly framed as a response to Bounce. (08 May 2020)

This week's threat model Thursday looks at an academic paper, Security Threat Modeling: Are Data Flow Diagrams Enough? by Laurens Sion and colleagues. (23 Apr 2020)

These are the books I read in the first quarter (and forgot to mention last quarter) that I think are worth your time. (14 Apr 2020)

On Linkedin, Peter Dowdall had a very important response to my post on remote threat modeling. (02 Apr 2020)

How do we replace the in-person whiteboard sessions essential to Threat Modeling when we are distanced and working remotely? (30 Mar 2020)

Pandemic Safety in Star Wars (27 Mar 2020)

New training being developed, seeking interest. (26 Mar 2020)

I know many readers are here for the threat modeling, and I could claim that this is the “what are we going to do about it” post, which it is, but I don't want to have to blog all threat modeling all the time. So this is the “Seattle is a month into COVID-19” post. (23 Mar 2020)