WeAreDevelopers Logo WeAreDevelopers
Sign in
For You LIVE
World Congress 2024 • Aug 20, 2024 • Session details

Real-world Threat Modeling

Ali Yazdani

Stop treating security as an afterthought. Shift left with the STRIDE framework to catch and eliminate critical vulnerabilities before a single line of code is written.

Pause
Mute Enter Fullscreen
#1 about 2 min

Real-world consequences of missing threat modeling

Real-world examples like a costly Kubernetes API vulnerability demonstrate the need for early security measures.

#2 about 2 min

Expanding the shift left security journey

Transitioning from late-stage testing to secure pipelines shifts security earlier into the design phase.

#3 about 2 min

Defining threat modeling in secure design

Threat modeling provides a structured way to identify and mitigate risks between the design and coding phases.

#4 about 4 min

Core terminologies and relationships in threat modeling

Mapping the cascading relationship between system weaknesses, exploitable vulnerabilities, and attacks clarifies overall risk.

#5 about 2 min

Using the STRIDE threat modeling methodology

The STRIDE framework categorizes threats into spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege.

#6 about 2 min

Adopting an iterative threat modeling workflow

Effective threat modeling requires a continuous loop of diagramming data flows, ranking risks, and deploying mitigations.

#7 about 2 min

Mapping STRIDE to data flow diagrams

Applying STRIDE categories directly to system processes, data stores, and external entities exposes critical security boundaries.

#8 about 3 min

Four strategies for addressing identified security threats

Handling discovered vulnerabilities involves choosing whether to mitigate, eliminate, transfer, or formally accept the business risk.

#9 about 3 min

Scoping systems with multi-level data flow diagrams

Deconstructing an application from a high-level overview down to specific components establishes clear trust boundaries.

#10 about 3 min

Implementing threat models with OWASP Threat Dragon

Visualizing diagrams with open-source tools tracks component threats and verifies the presence of appropriate mitigation controls.

#11 about 1 min

Recommended resources for continuous threat modeling education

Studying practical examples and reference implementations helps integrate threat modeling practices into everyday engineering workflows.

Matching moments

3:07 min

Introducing collaborative threat modeling workshops in engineering teams

Bruno Amaro Almeida · World Congress 2022

1:32 min

Pairing with teams for continuous threat modeling

Nazneen Rupawalla · World Congress 2022

2:31 min

Addressing insecure design through early threat modeling

Christian Wenz Christian Wenz · World Congress 2026 Europe

4:07 min

Implementing a continuous threat modeling pilot program

Farshad Abasi Farshad Abasi · World Congress 2026 North America

2:35 min

Integrating security across the application development lifecycle

Niels Tanis Niels Tanis · World Congress 2022

2:00 min

Evolution of software development and threat modeling methodologies

Farshad Abasi Farshad Abasi · World Congress 2026 North America

More from World Congress 2024

Beyond the Hype: Real-World AI Strategies Panel thumbnail
24:07
about 1 year ago

Beyond the Hype: Real-World AI Strategies Panel

Mike Butcher, Jürgen Müller, Katrin Lehmann, Tobias Regenfuss

Carl Lapierre - Exploring Advanced Patterns in Retrieval-Augmented Generation thumbnail
21:17
almost 2 years ago

Carl Lapierre - Exploring Advanced Patterns in Retrieval-Augmented Generation

Carl Lapierre

Coding an Immersive Copilot using Unity / .NET and Azure OpenAI! thumbnail
31:50
about 2 years ago

Coding an Immersive Copilot using Unity / .NET and Azure OpenAI!

Zaid Zaim

Building a diverse tech company: The power of Diversity, Equity, Inclusion, and Belonging thumbnail
29:43
about 2 years ago

Building a diverse tech company: The power of Diversity, Equity, Inclusion, and Belonging

Sue Quackenbush

Livecoding with AI thumbnail
31:39
about 2 years ago

Livecoding with AI

Rainer Stropek

Dapr in Practice thumbnail
24:08
about 2 years ago

Dapr in Practice

marcklefter

Related videos

Your Threat Model Is Lying to You: Why Modeling the Design Isn’t Enough in 2026 thumbnail
30:06
World Congress 2026 North America • 12 days ago

Your Threat Model Is Lying to You: Why Modeling the Design Isn’t Enough in 2026

Farshad Abasi

Security Pitfalls for Software Engineers thumbnail
27:32
World Congress 2023 • about 3 years ago

Security Pitfalls for Software Engineers

Jasmin Azemović

You can’t hack what you can’t see thumbnail
29:34
LIVE • almost 6 years ago

You can’t hack what you can’t see

Reto Kaeser

Walking into the era of Supply Chain Risks thumbnail
37:36
LIVE • over 4 years ago

Walking into the era of Supply Chain Risks

Vandana Verma

Software Security 101: Secure Coding Basics thumbnail
1:58:48
World Congress 2021 • over 5 years ago

Software Security 101: Secure Coding Basics

Thomas Konrad

Climate vs. Weather: How Do We Sustainably Make Software More Secure? thumbnail
51:41
LIVE • over 4 years ago

Climate vs. Weather: How Do We Sustainably Make Software More Secure?

Related articles

From learning to earning

Jobs that call for the skills explored in this talk.