Threat Modeling for Secure Software Design
Learn about threat modeling for secure software design in this 46-minute conference talk from the Central Ohio InfoSec Summit 2016. Explore the fundamentals of threat modeling, its place in the development process, and practical tools for implementation. Discover how to conduct a typical threat modeling session, use simple tools like one-page models and worksheets, and apply security principles. Dive into the threat modeling process, including system understanding, STRIDE framework, and OWASP Cornucopia. Gain insights on identifying functional and identity threats, determining mitigations, and assessing risk. Examine a configuration management scenario and learn how to follow through on identified threats. Conclude with a challenge to apply these concepts and explore additional resources for threat modeling tools.