Preview Mode Links will not work in preview mode

Oct 29, 2017

Direct Link:

Adam Shostack has been a fixture of threat modeling for nearly 2 decades. He wrote the 'threat modeling' bible that many people consult when they need to do threat modeling properly.

We discuss the different threat modeling types (STRIDE, DREAD, Trike, PASTA) and which ones Adam enjoys using.

Mr. Boettcher asks how to handle when people believe an OS is better than another, how to do threat modeling to decide which OS should be the one to use.


Stay after for a special post-show discussion with Adam about his friend Stephen Toulouse (@stepto).



Youtube Channel:

#iTunes Store Link: 

#Google Play Store:


Join our #Slack Channel! Sign up at

#iHeartRadio App:


Comments, Questions, Feedback:

Support Brakeing Down Security Podcast on #Patreon:

#Twitter: @brakesec @boettcherpwned @bryanbrake @infosystir

#Player.FM :

#Stitcher Network:

#TuneIn Radio App:






Ideas and suggestions here:


Start with “What is threat modeling?”   What is it, why do people do it, why do organizations do it?

What happens when it’s not done effectively, or at all?


At what point in the SDLC should threat modeling be employed?



Can threat models be modified when new features/functionality gets added?

Otherwise, are these just to ‘check a compliance box’?

Data flow diagram (example) -


process flow

External entities


Multiple Processes

Data Store

Data Flow

Privilege Boundary


Classification of threats-




Trike -


Butler Lampson, Steve Lipner link:


Escalation Of Privilege card game:


NIST CyberSecurity Framework:


Data Classification Toolkit -

Microsoft bug bar (security) -

Microsoft bug bar (privacy) -

OWASP threat Modeling page:

OWASP Threat Dragon -

Emergent Design:


Robert Hurlbut (workshop presenter at SourceCon Seattle) (much the same content as given at Source)


Adam’s Threat modeling book -- sponsored link


Is the book still applicable?

New book


What traps do people fall into?  Attacker-centered, asset-centered approaches

Close with “how do I get started on threat modeling?”

SecShoggoth’s Class “intro to Re”

Johari window?