Threat Modeling and Star Wars
[no description provided]IANS members should have access today to a new faculty report I wrote, entitled "Threat Modeling in An Agile World." Because it's May the Fourth, I thought I'd share the opening:
As Star Wars reaches its climax, an aide approaches Grand Moff Tarkin to say, “We've analyzed their attack pattern, and there is a danger.” In one of the final decisions he makes, Tarkin brushes aside those concerns. Likewise, in Rogue One, we hear Galen Urso proclaim that the flaw is too subtle to be found. But that's bunk. There's clearly no blow-out sections or baffles around the reactor: if there's a problem, the station is toast. A first year engineering student could catch it.
You don't have to be building a Death Star to think about what might go wrong before you complete the project. The way we do that is by “threat modeling,” an umbrella term for anticipating and changing the problems that a system might experience. Unfortunately, a lot of the advice you'll hear about threat modeling makes it seem a little bit like the multi-year process of building a Death Star.