The document discusses threat modeling and how most security measures are implicit rather than explicit. It recommends making threat modeling explicit by following Schneier's Security Wheel to evaluate each security measure: assessing assets, risks, how the measure mitigates risks, new risks it creates, and costs/trade-offs. The speaker argues for bringing all security measures into an explicit threat model, getting diverse input, ensuring each measure addresses credible threats, regularly reviewing the model, and removing outdated measures. The goal is to eliminate "security theater" and make security evaluation everybody's responsibility.

1. Threat Modeling
Revolutionized!
San Francisco Perl Mongers, 2012/03/27
David Fetter
david@fetter.org
Copyright© 2012, All rights reserved.

2. Why I'm Doing This

3. Every Security Measure
is in a threat model

4. Implicit Explicit
1%
explicit
99%

5. Schneier's Security Wheel
?
¥
£

6. Schneier's Security Wheel
1. What assets are we trying to protect?
?
¥
£

7. Schneier's Security Wheel
1. What assets are we trying to protect?
2. What are the risks to those assets?
?
¥
£

8. Schneier's Security Wheel
1. What assets are we trying to protect?
2. What are the risks to those assets?
3. How well does the security measure mitigate those risks?
?
¥
£

9. Schneier's Security Wheel
1. What assets are we trying to protect?
2. What are the risks to those assets?
3. How well does the security measure mitigate those risks?
4. What other risks does the security measure cause?
?
¥
£

10. Schneier's Security Wheel
1. What assets are we trying to protect?
2. What are the risks to those assets?
3. How well does the security measure mitigate those risks?
4. What other risks does the security measure cause?
?
¥
5. What costs and trade-offs does the security measure impose? £

11. Schneier's Security Wheel
1. What assets are we trying to protect?
2. What are the risks to those assets?
3. How well does the security measure mitigate those risks?
4. What other risks does the security measure cause?
?
¥
5. What costs and trade-offs does the security measure impose? £
6. GOTO 1.

12. IMPLICIT

13. Security Theater

14. also known as

15. Ludicrous Bullshit

16. Huge Risk!

17. Fix the Problem

19. 1. Bring each security measure into the explicit model.

20. 1. Bring each security measure into the explicit model.
2. Engage the widest possible audience in the review.

21. 1. Bring each security measure into the explicit model.
2. Engage the widest possible audience in the review.
3. Ensure each measure credibly mitigates at least one credible threat.

22. 1. Bring each security measure into the explicit model.
2. Engage the widest possible audience in the review.
3. Ensure each measure credibly mitigates at least one credible threat.
4. Review the threat model regularly.

23. 1. Bring each security measure into the explicit model.
2. Engage the widest possible audience in the review.
3. Ensure each measure credibly mitigates at least one credible threat.
4. Review the threat model regularly.
5. Remove security measures that no longer fit.

24. 1. Bring each security measure into the explicit model.
2. Engage the widest possible audience in the review.
3. Ensure each measure credibly mitigates at least one credible threat.
4. Review the threat model regularly.
5. Remove security measures that no longer fit.
6. GOTO 1

25. Security is Everybody's Job!

26. Thanks!
• Meredith Patterson, who helped me realize
that this wasn't just an idle stray thought.
• Devdas Bhagat (who turned me on to
Complex Adaptive Systems)

27. Questions?
Comments?
Straitjackets?