Podcast: DevSecOps
I recently chatted with Mark Miller over at DevSecOps
Shostack + Friends Blog
Recent Blog Posts, Page 34
The Queen of the Skies and Innovation
Innovation, regulation, and more.
Nature and Nurture in Threat Modeling
What comes easily should still be taught and elaborated upon.
Fire Doesn't Innovate by Kip Boyle (Book Review)
An unexpected book review.
Incentives and Multifactor Authentication
What if we gamified security?
Threat Modeling: Attackers May Adapt, Respond
Reasons for failure in real-world security
Threat Modeling as Code
Exploring threat models as code.
LinkedIn Learning: Producing a Video
My Linkedin Learning course is getting really strong positive feedback. Today, I want to peel back the cover a bit, and talk about how it came to be.
IriusRisk 2.0
I’m excited to be able to share “Announcement: IriusRisk Threat Modeling Platform 2.0 Released.”
Scaling Threat Modeling Training
For the last few years, I've been delivering in-person threat modeling training. I've trained groups ranging from 2 to 100 people at a time, and I've done classes as short as a few hours and as long as a week.
Beyond Elf on a Shelf
Happy Holidays!
High ROI Security Advisory Boards
Discussing the value of Security Advisory Boards
Pivots and Payloads
A new game from SANS for understanding pen test methodology, tactics, and tools.
Resources for Infosec Skillbuilding
The Threat Modeling Book has been featured on a list of resources by Digital Guardian.
House Oversight Committee on Equifax
The House Oversight Committee has released a scathing report on Equifax...