Video Series
Not usually one for the video format, I'm expanding my horizons thanks to 2020 being what it is.
Shostack + Friends Blog
Recent Blog Posts, Page 25
Software Engineering Radio
I enjoyed being a guest on Software Engineering Radio in this in depth interview.
Amicus Brief on CFAA
I recently signed onto the amicus brief on the Van Buren/Computer Fraud and Abuse Act filed by the Electronic Frontier Foundation.
Internet Society Opposition to LAED Act
The Internet Society Open Letter Against Lawful Access to Encrypted Data Act was published this morning.
Threat Model In My Devops
A recent talk by Alyssa Miller focuses on integrating threat modeling in devops.
Threat Modeling and the SAFE Framework
My thoughts on an interesting blog post discussing how to bring threat modeling into the Scaled Agile Framework.
The Cyentia Library Relaunches
I'm excited to see that they're Re-introducing the Cyentia Research Library, with cool (new?) features like an RSS feed. There are over 1,000 corporate research reports with data that companies paid to collect, massage, and release in a way they felt would be helpful to the rest of the world.
Happy Juneteenth!
Juneteenth is the celebration of the end of slavery in the US. We need more holidays that celebrate freedom. Freedom isn't always comfortable or easy, but it is the precondition to the pursuit of happiness.
The Jenga View of Threat Modeling
I'm happy to announce Shostack + Associate's new, first, corporate white paper! It uses Jenga to explain why threat modeling efforts fail so often.
Threat Research: More Like This
I want to call out some impressive aspects of a report by Proofpoint.
Sonatype Report on DevSecOps
The Sonatype 2020 DevSecOps Community Survey is a really interesting report. Most interesting to me is the importance of effective communication, with both tools and human communication in developer happiness.
Contextualisation of Data Flow Diagrams...
Contextualisation of Data Flow Diagrams for security analysis is a new paper to which I contributed.
'Best Practices for IoT Security'
There's an interesting new draft, Best Practices for IoT Security: What Does That Even Mean? by Christopher Bellman and Paul C. van Oorschot.
Evidence Based Security
Check out “The Need for Evidence Based Security” by Chris Frenz.
One Bad Apple
I generally try to stay on technical topics, because my understanding is that's what readers want. But events are overwhelming and I believe that not speaking out is now a political choice.