Re:Redefining Threat Modeling: Security team goes on vacation
by baby on Thursday April 08, 2021 @02:37AM
(#26735779)
This articles points out the obvious: security engineers are fewer, it'd be cool if devs could run and maintain their own threat models, you can help people with trainings, STRIDE can be useful for beginners.
What it doesn't address are what I think are the important points of a threat model:
* What tool or format do you use for threat modeling? There's unfortunately not many solutions. Sure you can do whatever, but uniformity helps (as opposed to every team using a different format) and spreadsheets really suck. I think there's really a need for a tool/SaaS in the space.
* How do integrate threat modeling in your processes? Doing a threat model once is nice, but you need to re-visit it often and make sure it's up to date.
* How do you analyze the outcome? Threat modeling is the perfect tool to identify gaps and prioritize security work, unless people discard it as soon as they're done with it. How do you milk what you've done, and how do you make sure others prioritize what came out of the threat modeling exercise?
What it doesn't address are what I think are the important points of a threat model:
* What tool or format do you use for threat modeling? There's unfortunately not many solutions. Sure you can do whatever, but uniformity helps (as opposed to every team using a different format) and spreadsheets really suck. I think there's really a need for a tool/SaaS in the space.
* How do integrate threat modeling in your processes? Doing a threat model once is nice, but you need to re-visit it often and make sure it's up to date.
* How do you analyze the outcome? Threat modeling is the perfect tool to identify gaps and prioritize security work, unless people discard it as soon as they're done with it. How do you milk what you've done, and how do you make sure others prioritize what came out of the threat modeling exercise?