As applications and infrastructures become more complex and distributed, threat modeling has transformed into a continuous, integral part of modern DevSecOps. This post revisits threat modeling fundamentals and introduces the latest standards, methodologies, and technologies shaping this critical discipline today.
Learn how to secure the software supply chain by embracing best practices such as secure coding, CI/CD integration, SBOMs, and proactive monitoring.
I had the pleasure of presenting a talk at the Devops Sydney meetup group. The session was recorded and is here The slides used in the presentation are below
I had the pleasure of presenting a lightning talk at the Cloud Native summit at Wellington - New Zealand . The session was recorded and is here
In a world increasingly reliant on digital infrastructure, security is no longer a static state but a continuous process. Reactive security is a gamble no organization can afford. Proactive defense is paramount, and threat modeling stands as a crucial first line of defense. Threat modeling provides a structured approach to proactively identify and mitigate security risks. It’s about stepping into the mindset of an attacker, systematically examining your systems—whether a complex application, a sprawling network, or a cloud deployment—to pinpoint potential weaknesses. Threat modeling uncovers potential vulnerabilities, maps likely attack paths, and empowers teams to fortify their defenses preemptively. This process involves visualizing attack vectors, assessing potential impact, and prioritizing mitigation efforts. More than a mere checklist, it’s a dynamic process that blends analytical rigor with creative foresight, enabling you to anticipate and mitigate threats before they materialize. ...