Explore a pragmatic approach to threat modeling in application security with this 47-minute conference talk from GrrCon 2016. Learn why threat modeling is crucial, understand the challenges preventing its widespread adoption, and discover a practical methodology for implementing it effectively. Delve into architecture-driven threat modeling, its integration with the software development lifecycle, and how it enhances security testing and prioritization. Gain insights on simplifying the process to ensure its sustainability and impact on overall application security.

Syllabus

Intro
Introductions
Why Do We (or should we) Threat Model
So Why Don't We Threat Model?
Ideal Threat Modeling
A Pragmatic Approach
Architecture/Design Driven
The Methodology
Ensuring All Is Not Lost
Feeding the SDLC
Improve Security Testing
Enable Security Prioritization
Keep It Simple Stupid