APPSEC Cali 2018 - Threat Modeling Toolkit

by Jonathan Marcil, Application Security Engineer at Twitch

Abstract:
Threat Modeling is a great way to analyze security early in software development by structuring possible attacks, bad actors and countermeasures over a broad view of the targeted system. This talk will describe basic components of a threat model and how to use them effectively. Modeling concepts will be demonstrated using a cryptocurrency ecosystem as example.

by Jonathan Marcil, Application Security Engineer of Twitch

Jonathan Marcil is the former chapter leader of OWASP Montreal and is now based in beautiful Irvine, California. Jonathan has been involved with OWASP for many years and is behind the official OWASP YouTube channel. He was also part of NorthSec CTF as a challenge designer specialized in Web and imaginative contraptions. He is passionate about Application Security and enjoys architecture analysis, code review, threat modeling and debunking security tools. He holds a bachelor's degree in Software Engineering from ETS Montreal and has more than 15 years of experience in Information Technology and Security.

[RoyObrecht]

Very useful and pragmatic approach Jonathan Marcil. Well done.

[Rookey_Traveller]

Thanks for your help. Is there any open source tool for DREAD methodology?

[strayapanda]

is there any programmatic tool to create the DFD?