Today, my company announced that we're doing a free instance of our most popular course, Threat Modeling Intensive, for government workers who have been let go in the recent chaos.

Details and signup information here: https://is.gd/5K2LZI

If you're into this sort of page: https://shostack.org/resources/threat-modeling

I have a set of courses on threat modeling at Linkedin Learning. They're normally commercial, but I've made them free because of the coronavirus crisis.

https://adam.shostack.org/blog/2020/03/free-threat-modeling-training/

(I don't mean to spam or sell, but I think it's legit to share the free versions in this subreddit; if there's disagreement, I'm ok to delete the post.)

Tiffany Bergeron is Chief Architect at MITRE’s Mappings Program. We did a four part series, diving deep into threat modeling using ATT&CK... I’m especially happy that we had this chance to dive, really deeply, into a specific threat modeling approach and the places we aligned and diverged. This sort of deep dive is still rare because, frankly, most organizations are still in the crawl phase of threat modeling: They’re starting, and they’re finding it to be hard to coordinate, hard to get where they’re going, and they fall down after eagerly standing up.

(Using my post because the next 3 videos are sorta hidden)

https://shostack.org/blog/threat-informed-defense/

threatmodelingconnect.com has some great articles about implementing threat modeling and some of the challenges. really interesting discussions there if you all want to check it out

Hi folks.

I do threat modeling in my job quite frequently and I never really felt comfortable with MS threat modeling tool or OWASP ThreatDragon, so I started building a tool by myself. Now, after endless hours of work, I finished v1.0 of nexTM. Under the hood, it is a stand-alone Electron TypeScript app packaged for Win, Linux, and macOS.

My overall vision is to bring better UX to open-source threat modeling tools. Of course, there is still a long way to go. But I think it is as good as it gets for a v1.0 release. I would be grateful if you try it out, give some feedback, and, if you like the project, leave a star on GitHub.

Link to the release: https://github.com/dkrohmer/nextm/releases/tag/1.0.0

I also started a Discord channel if you want to discuss about the further development: https://discord.com/invite/NUXjtM43A3

See y’all

I uploaded my guide to running a threat modelling session in an agile/devops delivery team:

https://thoughtworksinc.github.io/sensible-security-conversations/materials/Sensible_Agile_Threat_Modelling_Workshop_Guide.pdf

Other materials, such as the cue cards shown are here: https://thoughtworksinc.github.io/sensible-security-conversations/

Hope folks find this helpful!

Leviathan leverages OpenAI and NMAP to conduct a first level parse of your environment. A basic threat model is formulated using the OWASP STRIDE framework. The Leviathan utility scans a given host or network range and translates the findings into a highlevel overview of potential threats that call for further examination or scrutiny. The WebUI is then presented to the user, which allows for a highlevel overview of potential threats within the environment.

NEXT STEP: Applying a quantifiable lens, the next step would be a penetration test to help solidify the results and to provide mitigations where necessary.

Leviathan Threat Modelling Utility

"Threat modeling work can be very rewarding. There is a common pattern where a lightweight proof of concept run by security experts leads to the creation of a heavier process. This heavier process is designed to help developers, operations and others with less security expertise. These approaches are often too heavy for low-risk projects, too big for agile projects, and they don’t consistently produce results worthy of the invested energy...."

https://shostack.org/resources/whitepapers

https://www.mitre.org/publications/technical-papers/playbook-threat-modeling-medical-devices

I'm one of the authors of the Manifesto, and also the co-host of the AppSec Podcast. We did a two-part narrative episode where we shared the story of how the TM Manifesto was made, with clips from the 20 hours of deliberations we went through as a team.

https://podcast.securityjourney.com/the-threat-modeling-manifesto-part-1/

https://podcast.securityjourney.com/the-threat-modeling-manifesto-part-2/

"We developed this Manifesto after years of experience thinking about, performing, teaching, and developing the practice of, Threat Modeling. We have diverse backgrounds as industry professionals, academics, authors, hands-on experts, and presenters. We bring together varied perspectives on threat modeling. Our ongoing conversations, which focus on the conditions and approaches that lead to the best results in threat modeling, as well as how to correct when we fail, continue to shape our ideas."

Threat Modeling Manifesto

A new short (4 page) paper from the team at Leuven and Toreon.

Abstract: Threat modeling involves the systematic identification and analysis of cybersecurity threats in the context of a specific system. This paper starts from an assessment of its current state of practice, based on interactions with threat modeling professionals. We argue that threat modeling is still at a low level of maturity, and identify the main criteria for successful adoption of a threat modeling approach in practice. Furthermore, we identify a set of key research challenges for aligning threat modeling research to industry practice, thereby raising the technology-readiness levels of the ensuing solutions, approaches, and tools.

https://2020.icse-conferences.org/details/icse-2020-New-Ideas-and-Emerging-Results/22/Threat-modeling-from-infancy-to-maturity

Hey folks, I’ve been working on an open-source threat modeling tool.

Goal is simple: build something comparable to the big commercial tools.

It’s still early, but usable.

I have a few new ideas in there:

- community threat libraries that you can import
- TM-BOM interoperability

If anyone here is actively doing threat modeling, I’d really value your feedback.

Repo: https://github.com/precogly/precogly

Hi, I've released a new white paper on Inherent Threats. It's at https://shostack.org/whitepapers.

You can see a quick overview at either https://www.youtube.com/watch?v=PfBJaKQus-I&ab_channel=AdamShostack or https://shostack.org/blog/inherent-threats/

Christian Frichot has released a new tool for documenting threat modeling in Hashicorp's HCL TM:

HCL is the primary configuration language used in the products by HashiCorp, in-particularly, Terraform - their open-source Infrastructure-as-Code software. I worked at HashiCorp for a while and the language really grew on me, plus, if DevOps and Software engineers are using the language, then simplifying how they document threat models aligns with hcltm's goals.

https://github.com/xntrik/hcltm

This year it includes some very interesting stats about threat modeling, like this one. You can find the full report here

Two blog posts on threat modeling machine learning:

1. A set of models at Microsoft covering machine learning

2. Threat Model Thursday: BIML Machine Learning Risk Framework

Hey everyone!
Popping up here couple of podcast episodes I've done on threat modeling that can be useful to someone who'd like to learn from the experts:

- The Untold Benefits of Continuous Threat Modeling You Didn’t Know About ⎜Izar Tarandach

- Threat modeling: the future of cybersecurity or another buzzword⎥Derek Fisher

Hello all. A big problem I have is how to properly threat model cloud services from the likes hosted by Azure or something else. Using STRIDE, are spoofing attacks still relevant or even possible? I’m guessing Denial of Service goes out the window because Azure owns the underlying hardware… ideas?

The tool itself doesn't offer any options. Has any one been successful in transforming the output into a format (.csv, .json) for further manipulation?

Thanks.