Threat modeling from the trenches to the clouds

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

#RSAC
SESSION ID:SESSION ID:
#RSAC
Brook S.E. Schoenfield
Threat Modeling From The Trenches To The Clouds
AIR-W02
Passiona...

#RSAC
“TM” == Threat Modeling!

#RSAC

#RSAC
Based Upon What?
Trained 100’s of security architects over 15+ years
51 Intel Security TM training sessions
TM every...

#RSAC
From What Exprience Is This Drawn?
Trained 100’s of security architects over 15 years
51 Intel Security TM training ...

#RSAC
Threat modeling is a technique to identify the
attacks a system1 must resist and the defenses
that will bring the sy...

#RSAC
Our Collective Challenge == Secure Design
Little progress in 20+ years!
Early standard = NIST 800-14, 1996!
Is it si...

#RSAC
Consider Recent Design Misses
That Jeep Wrangler
Open WiFi Pacemaker
The Target breach was a system design failure

#RSAC
Old Guard
Central team
• Consultants
/employees
Parachute
into project
Find as many
“flaws1” as
possible
Generate
re...

#RSAC
Old Guard
Central team
• Consultants
/employees
Parachute
into project
Find as many
“flaws1” as
possible
Generate
re...

#RSAC
Are These Your Challenges?
Only staff critical apps
Fight between “creativity” & “security”
Security requirements do...

#RSAC
Be Different!
Decentralize
Fully empower
Skill can be built, difficult to buy
1-2 highly skilled hires who both exec...

#RSAC
Be Different!
Decentralize
Fully empower
Skill can be built, difficult to buy
1-2 highly skilled hires who both exec...

#RSAC
Grassroots
TM is part of the ”woodwork”, the “expected” flow
Go viral: build generations of teachers
Leverage each l...

#RSAC
Involve Everyone
Team sport
Everyone! Really!
It takes a village to build a complete threat model
Prioritization is ...

#RSAC
A threat model is a crossroads of knowledge from
architecture experts, domain experts, and security
experts
Absence ...

#RSAC
Iteration Is Your Friend
Let the threat model breathe
Security implementation can improve through iteration
Changes ...

#RSAC
Prioritizing
Risk is the way!
Calculating risk is difficult
Adopt an easy risk analysis methodology
Just Good Enough...

#RSAC
Prioritizing
Risk is the way!
But that’s hard
Adopt an easy risk analysis methodology
Just Good Enough Risk Rating1 ...

#RSAC
Get Out And See The Architectural World
Analyze unfamiliar architectures and unfamiliar structural types
Build skill...

#RSAC
“Keystone” activity
Participation results:
Why security is crucial
What to worry about and what not
Sense of the ris...

#RSAC
Governance
Central boards are a bottleneck
The best don’t have to “approve” everything

#RSAC
Peer Review  Governance
Central boards are a bottleneck
The best don’t have to “approve” every model

#RSAC
Learn By Doing
Experience -> Reflection -> Integration1
Let participants find personal learning
Active participation...

#RSAC
The Downside
Trees for the forest analyses
Accepting component threat models w/o analysis
Lose the centre
Poor visib...

#RSAC
Take Aways
Build, because we couldn’t buy/hire
Grassroots + management + executives
Train & mentor as though our liv...

#RSAC
Shameless Self-promotion
https://www.facebook.com/securingsystems

#RSAC
A Threat Modeling Library
https://www.facebook.com/securingsystems

#RSAC
Developer-centric Security
Enable creativity and innovation
Secure innovation
Let’s start a movement!

#RSAC
Some Resources
https://www.owasp.org/index.php/Application_Threat_Modeling
https://www.owasp.org/index.php/Threat_Ri...

#RSAC
Where To Find Me
Brook.e.schoenfield@intel.com
http://www.brookschoenfield.com
brook@brookschoenfield.com
@BrkSchoen...

#RSAC
Brook’s Social Networking
https://www.linkedin.com/in/brookschoenfield 1
http://www.amazon.com/Brook-S.-E.-Schoenfie...

#RSAC
www.brookschoenfield.com

Share Slideshare

LinkedIn
Facebook
Twitter

Embed

Size (px)

Show related Slideshows at end

WordPress Shortcode

Link

Share
Email

2024 Trend Updates: What Really Wor... by Search Engine Jou... 1063109 views
Storytelling For The Web: Integrate... by Chiara Aliotta 981811 views
Artificial Intelligence, Data and C... by OECD Directorate ... 923520 views
How to Leverage AI to Boost Employe... by SocialHRCamp 392340 views
2024 State of Marketing Report – by... by Marius Sescu 221896 views
Everything You Need To Know About C... by Expeed Software 237729 views

View on Slideshare

1 of 33 Ad

View on Slideshare

1 of 33 Ad