Securing Open Source Through Threat Modeling

This session explains threat modeling as a way to identify attack surfaces and security flaws in open-source projects. It demonstrates the process with vulnerability examples from Harbor and NATS, and discusses supply chain attacks and mitigation.

Syllabus

Introduction
Agenda
What is Threat Modeling
Why should we do Threat Modeling
Threat Modeling 101
Threat Modeling in the Beginning
Advanced Threat Modeling
Known vs unknown vulnerabilities
Setting clear objectives
Understanding how the application works
What can go wrong
CWE
OSS Top 10
Stride
Verification
Supply Chain Attacks
What is Supply Chain Attack
Outdated Libraries
You are not the target
OpenSSL
Informationally
Legacy code
Automatic tools
Mitigation
Problems with security products
Summary