Shostack + Friends Blog

The serious side of the book (17 Jan 2023)

Like the Force, each threat has a light side, and a dark side. (16 Jan 2023)

Threat Modeling is the software version of measure twice, cut once. (12 Jan 2023)

External changes will be driving appsec in 2023. It’s time to frame the decisions in front of you. (05 Jan 2023)

Thoughts on the last 747, and engineering culture. (30 Dec 2022)

Looking at a threat model for curl, the command line web client. (29 Dec 2022)

A new paper on how fast, cheap and good can combine into something we usually discount. (28 Dec 2022)

More thoughts about AI and threat modeling (25 Dec 2022)

A straw goat that has not been burned. (25 Dec 2022)

The best gift for 2023 (23 Dec 2022)

Pointer to Adam’s latest Darkreading article (22 Dec 2022)

Usable security matters (21 Dec 2022)

Books that I read in the fourth quater that are worth your time include several about safety with lessons for cybersecurity (19 Dec 2022)

Interesting space news, including ISS and 3d printed engines (18 Dec 2022)

Legal commentary on the Second Death Star Project (16 Dec 2022)