Adam Shostack on Threat Modeling

Abstract

Adam Shostack, of Shostack & Associates and author of Threat Modeling: Designing for Security, discusses threat modeling, its benefits, and how to add it to an organization’s existing software process. Host Justin Beyer spoke with Shostack about asset-, threat-, and software-centric approaches; diagramming applications and introducing trust boundaries; methods such as spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege as well as the kill chain and the Elevation of Privilege card game; tooling; bug bars; privacy threats; linkability, identifiability, nonrepudiation, detectability, disclosure of information, unawareness, and noncompliance; selling threat modeling to an organization; and threat modeling for the Internet of Things. We provide summary excerpts below; to hear the full interview, visit http:// www.se-radio.net or access our archives via RSS at http://feeds.feedburner.com/ se-radio.