The Empire’s Threat Modeling
Get one fourth off for May the fourth!
Shostack + Friends Blog
Recent Blog Posts, Page 9
Appsec Roundup - April 2025
Threat modeling. So much threat modeling, and so much more, including foreshadowing of new rules from FDA.
Threat Informed Defense Series
A great, in depth series on threat modeling with ATTACK
CVE Futures
What’s next for the CVE program?
Andor, Season 2
Excited for Star Wars: Andor Season 2
Free Threats
Pray they don’t alter the price any further
A few thoughts on CVE
Thoughts on the CVE funding crisis
Assets, Again
What's wrong with this process?
Learning from Troy Hunt’s Sneaky Phish
Troy Hunt has a good post about being phished. Good on Troy for being transparent, and he talks about being tired and jet lagged, and that deserves sympathy. Attackers are sneaky. Troy honorably admits that he overrode 1Password and filled out the phishing site. In this post, I want to share why I think I wouldn’t fall for this, even jet lagged.
Appsec Roundup - March 2025
Big news for LLMs in threat modeling!
Introducing the DEF CON 32 Hackers' Almanack
Grateful to introduce the Hackers' Almanack!
Security Researcher Comments on HIPAA Security Rule
A group of us have urged HHS to require better handling of security reports
OWASP Training in Barcelona
Register for OWASP training in Barcelona!
The Covid pandemic, 5 years on
Thinking about Covid, five years on.
The First Constitutional Crisis of 2025
Hoping to add a little clarity to the situation