In this episode, Matt Tesauro hosts Adam Shostack to talk about threat modeling - not only what it is but what Adam has learned from teaching numerous teams how to do threat modeling. Learn what makes a good threat model and some news about a new book from Adam to help further the spread of threat modeling with the end goal of more threat modeling and fewer security surprises.  Enjoy!

Show Links:
- Threats Book site: https://threatsbook.com/
- Resources on Adam’s website: https://shostack.org/resources

OWASP Podcast

Threat Modeling using the Force with Adam Shostack - OWASP Podcast e001

Annotations and transcribed highlights: http://www.brainpickings.org/2015/06/16/neil-gaiman-how-stories-last

Recorded at the Long Now Foundation (http://longnow.org/) on June 9, 2015. 

Follow @https://soundcloud.com/longnow and subscribe to the podcast of their excellent seminars on long-term thinking on iTunes: https://itunes.apple.com/us/podcast/seminars-about-long-term-thinking/id186908455?mt=2

MORE / TRANSCRIPT

Neil Gaiman on how stories last

"The guy who wrote wifi software with SSID never imagined that someone could use that SSID to transmit data by writing two smaller applications to leverage it. We are constantly going to be in this [type of] battle. Ultimately we've got to find a way to stay ahead of it by understanding the mechanisms by which we're writing the abuse case possibilities." -- Shannon Lietz

Following their session at DevOps Enterprise Summit 2018, I sat down and talked with Shannon Lietz and James Wickett to talk about who the real adversaries are when it comes to application security, what you can do to expose those adversaries and steps to get started in your own, internal adversary program.

About Shannon Lietz
DevSecOps Leader for Intuit

Shannon Lietz is an award winning innovator with over two decades of experience pursuing advanced security defenses and next generation security solutions.  Ms. Lietz is currently the DevSecOps Leader for Intuit where she is responsible for setting and driving the company’s DevSecOps and cloud security strategy, roadmap and implementation in support of corporate innovation.  She operates a 24x7 DevSecOps team that specializes in Adversary Management.  Prior to joining Intuit, Ms. Lietz worked for ServiceNow where she was responsible for the cloud security engineering efforts and Sony where she drove the implementation of a new secure data center.  

Ms. Lietz has significant experience leading crisis management large-scale security breaches and restoration of services for several Fortune 500 companies.  She has previous experience as a founder a metrics company, leading major initiatives for hosting providers as a Master Security Architect, developing security software and consulting for many Fortune 500 companies globally.  Ms. Lietz is an IANS faculty member and holds a Bachelors of Science degree in Biological Sciences from Mount St. Mary’s College.

About James Wickett
Head of Research, Signal Sciences

James spends a lot of time at the intersection of the DevOps and Security communities. He works as Head of Research at Signal Sciences and is a supporter of the Rugged Software and DevSecOps movements. Seeing the gap in software testing, James founded an open source project, Gauntlt, to serve as a Rugged Testing Framework. He is the author of several security and DevOps courses onLinkedIn Learning, including: DevOps Foundations, Infrastructure as Code, DevSecOps: Automated Security Testing, Continuous Delivery (CI/CD), and Site Reliability Engineering.

He got his start in technology when he founded a startup as a student at the University of Oklahoma and has since worked in environments ranging from large, web-scale enterprises to small, rapid-growth startups. He is a dynamic speaker on topics in DevOps, AppSec, InfoSec, cloud security, automated security testing, DevSecOps and serverless.

James is the creator and founder of the Lonestar Application Security Conference which is the largest annual security conference in Austin, TX. He also runs DevOps Days Austin and previously served on the global DevOps Days board. He also bears several security certifications including CISSP and GWAPT.

with Shannon Lietz and James Wickett

Spy vs Spy in Application Security: Harvesting Adversaries

The OWASP Podcast Series is a recorded series of discussions with thought leaders and practitioners who are working on securing the future for coming generations.

Spy vs Spy in Application Security: Harvesting Adversaries

The OWASP Podcast Series

Related tracks