Get On With The Program: Threat Modeling In and For Your Organization

The importance of documenting and using threat models in cybersecurity and DevOps

• Threat models should be stored and available in places that people know where to find them and how to relate and change them
• Threat models can be used to define security contracts and find commonalities for platforming
• Templates are useful for making threat models consistent and easy to compare
• Everyday tools can be used for automating boring parts of the system and dealing with low hanging fruit
• Threat models are living documents that should be updated and stored for future use

The speaker mentioned the importance of documenting tribal knowledge in threat models, as even old applications can have new vulnerabilities. By keeping threat models up-to-date and accessible, developers can avoid repeating the same mistakes and ensure that mitigations are in place.

You've read, heard, sensed and worried about Threat Modeling for a while now. Apparently, all the cool kids are doing it and there's a strong movement for everyone to do it. But what does that mean for your organization? What are the dials you can read and the levers you can push to build a Threat Modeling program that actually works for your environment? In this session we will look at what are the indicators in your organization that may help shape your Threat Modeling program, what this program may look like, and what data you'll be collecting in order to measure and improve its impact and efficacy. Do you do it yourself? Do you bring external help? Is it your Security Team or your developers who lead it? Security Champions? All teams do the same, or...? We will ask and answer these questions and more. You will leave with ideas of your next steps, equipped with ways to go and succeed, and to fail fast if necessary.