-
Book Overview & Buying
-
Table Of Contents
-
Feedback & Rating
Threat Modeling Best Practices
By :
Discovering and classifying threats can quickly become just busy work with no real value if a process for driving the practice in the organization does not exist. Nobody likes to see their work go unused, and creating a threat model as a one-off exercise limits its impact. However, driving a threat modeling practice largely depends on the size of the organization, the buy-in from leadership in both security and technology, as well as the tools to implement a practice. I’ve seen cases where threat modeling is simply a bolted-on exercise that is done once the design has been locked. This is too late in the pipeline to be effective, and it happens more often in places where the process is either not well defined or not well socialized. In other cases, it is a simple check-the-box task that is assigned to security folks and looks more like an architecture audit than a preemptive attempt at reducing risk. Not a complete waste of effort, but the...
Change the font size
Change margin width
Change background colour