OWASP AppSecUSA 2011: Simplifying Threat Modeling – Video

Video Link: https://www.youtube.com/watch?v=OAFy4BhvqBQ

OWASP AppSecUSA 2011: Simplifying Threat Modeling
Speaker: Mike Ware Is threat modeling too tough to produce actionable results? Is it too overbearing on resources? Does it demand too much documentation? Architects and developers often perceive threat modeling as being too difficult, heavy on documentation, and costly to both produce an initial threat model from a clean slate and to maintain it as the system evolves. During this talk, we #39;ll attempt to bust these myths and show how organizations can incrementally obtain better results over time while making threat modeling "seem easy." How does one simplify threat modeling? By removing the fluff and following 5-10 steps designed to produce 3 simple "security views" which architects, developers, and testers can act on: misuse/abuse view, asset flow view, and attack surface view. We #39;ll explain how organizations just getting started with threat modeling can leverage or enhance SDLC artifacts they already produce to illuminate these security views. We #39;ll also explain where these security views should be produced within a typical SDLC and who should create them. Finally, we #39;ll describe how these security views are used to develop a threat matrix which describes who your threats are, where they might attack, what they will go after, and how they will do it. For more information visit: bit.ly To download the video visit: bit.ly Playlist OWASP AppSec USA 2011: bit.lyFrom:ChRiStIaAn008Views:11 0ratingsTime:43:33More inScience Technology

Go here to read the rest:
OWASP AppSecUSA 2011: Simplifying Threat Modeling - Video