Shostack + Friends Blog

Contextualisation of Data Flow Diagrams for security analysis is a new paper to which I contributed. (09 Jun 2020)

There's an interesting new draft, Best Practices for IoT Security: What Does That Even Mean? by Christopher Bellman and Paul C. van Oorschot. (08 Jun 2020)

Check out “The Need for Evidence Based Security” by Chris Frenz. (04 Jun 2020)

I generally try to stay on technical topics, because my understanding is that's what readers want. But events are overwhelming and I believe that not speaking out is now a political choice. (03 Jun 2020)

As I built out my home studio to record videos for my distributed classes, I was lucky enough to be able to find an in-stock HDMI capture card, but those are harder and harder to find. As it turns out, you may be able to avoid the need for that with a mix of apps. (28 May 2020)

Phil Bull presents an interesting, generally convincing, argument in 'Why you can ignore reviews of scientific code by commercial software developers', with a couple of exceptions. (26 May 2020)

Understanding the way intrusions really happen is a long-standing interest of mine. (20 May 2020)

For Threat Model Thursday, I want to look at models and modeling in a tremendously high-stakes space: COVID models. (14 May 2020)

Most of my time, I'm helping organizations develop the skills and discipline to build security in. We give the best advice available, and I recognize that we're early in developing the science around how to build an SDL that works. (11 May 2020)

I want to talk about two books: Bounce, by Matthew Syed and Range, by David Epstein. I want to talk about them together in part because Range is explicitly framed as a response to Bounce. (08 May 2020)

This week's threat model Thursday looks at an academic paper, Security Threat Modeling: Are Data Flow Diagrams Enough? by Laurens Sion and colleagues. (23 Apr 2020)

These are the books I read in the first quarter (and forgot to mention last quarter) that I think are worth your time. (14 Apr 2020)

On Linkedin, Peter Dowdall had a very important response to my post on remote threat modeling. (02 Apr 2020)

How do we replace the in-person whiteboard sessions essential to Threat Modeling when we are distanced and working remotely? (30 Mar 2020)

Pandemic Safety in Star Wars (27 Mar 2020)