Presented at
SOURCE Seattle 2017,
Oct. 4, 2017, 1:30 p.m.
(90 minutes).
Threat modeling is a way of thinking about what could go wrong and how to prevent it. Instinctively, we all think this way in regards to our own personal security and safety. When it comes to building software, some teams either skip the important step of threat modeling in secure software design or, they have tried threat modeling before but haven't quite figured out how to connect the threat models to real world software development and its priorities. Threat modeling should be part of your secure software design process. Using threat modeling and some principles of risk management, you can design software in a way that makes security one of the top goals, along with performance, scalability, reliability, and maintenance.
Objectives:
Attendees will learn about Threat Modeling through understanding concepts and hands-on demos:
Introduction to Threat Modeling, including how to conduct a typical Threat Modeling session
Understand practical strategies in finding Threats
Determine proper Mitigations, and how to apply Risk Management with the Mitigations
Review methods of documenting Threats
Hands-on demo of one or two Real World Threat Modeling case studies
Hands-on demos of the Microsoft Threat Modeling Tool 2016 and/or OWASP Threat Dragon
This session will give an opportunity for attendees to practice and learn Threat Modeling through hands-on learning and team participation. This hands-on workshop will include learning how to build a Threat Model by decomposing an application into its basic components and data flows, identifying threats using STRIDE and/or other methods, determine risks of the threats and possible countermeasures, and review the resulting Threat Model to make sure it matches the original requirements.
NOTE: Though participants are not required to attend the previous session "Developing a Threat Modeling Mindset", it will help lay a foundation for the hands-on workshop.
Presenters:
-
Robert Hurlbut
- President at Robert Hurlbut Consulting Services
Robert Hurlbut, based in Enfield, CT, is a software security consultant and trainer. Robert is a Microsoft MVP for Developer Technologies and Security and holds the (ISC)2 CSSLP security certification. Robert has 30 years of industry experience in software security, software architecture, and software development. He speaks at user groups, national and international conferences, and provides training for many clients. You can follow Robert on his blog at https://roberthurlbut.com/blog and on Twitter at https://twitter.com/roberthurlbut and co-hosting on the Application Security Podcast at https://www.appsecpodcast.org.
Similar Presentations: