Security · draft 66 of 95, not in the published book · outline v1.0.0, 2018, frozen · 110 words · the 2018 file · read and review
Threat Modeling
In 2018 this was an outline: a title and "Topics to cover and ideas". It was never in the published book, and it is shown exactly as it was left. The second edition fills it from the articles the map names.
Threat Modeling is a technique used by security professionals to understand the side effects of a particular code journey or pattern.
Topics to cover and ideas
- helps with the two curses of developers
- Changes to the Brief
- Lack of accountability for those changes
- Threat modeling allows the brief to be locked, since new features will require a review of the threat modeling
- Not doing threat models means that that the 'Security implications of X have not been considered' (X is a project, a sprint, a new feature, a new integration with 3rd party, etc...)
- Threat model leads to the creation of risks which are then given to the business owners
Answered since, on the newsroom: Every risk is already accepted, Who are you protecting against?, Footprint and blast radius. The map row.