Application Security Development Lifecycle 5A: Is Threat Modeling Right For You?

re: Application Security Development Lifecycle 5A: Is Threat Modeling Right For You?

SME — Thu, 12 Jun 2008 20:32:40 GMT

Excellent post once again. Webappsec programs are in different stages of maturity in different orgs. It's important to introduce the right thing (scanning, static code review,...) at the right time for best ROI. This article makes a good case for when to introduce threat modeling.

Is Threat Modeling Right For You?

Microsoft Application Threat Modeling Blog — Thu, 19 Jun 2008 05:37:25 GMT

Great post by my friend and colleague around threat modeling in a series he's doing on application security

http://entwickler.com/itr/news/psecom,id,42519,nodeid,82.html

TrackBack — Fri, 20 Jun 2008 11:55:43 GMT

MSDN FLASH IRELAND - INTERNATIONAL RESOURCES - 30 June 2008

Microsoft Ireland Blog — Thu, 31 Jul 2008 05:51:56 GMT

a {color : #0033CC;} a:link {color: #0033CC;} a:visited.local {color: #0033CC;} a:visited {color : #800080;}

Is Threat Modeling Right For You?

Georgeo Pulikkathara's Microsoft Blog — Tue, 12 Aug 2008 20:33:07 GMT

  Be sure to check out Talhah Mir's blog on threat modeling. http://blogs.msdn.com/threatmodeling/

re: Application Security Development Lifecycle 5A: Is Threat Modeling Right For You?

Philip.Agcaoili — Sun, 08 Mar 2009 06:58:02 GMT

Hey Akshay.

What's interesting for us is where Threat Modeling worked and did not work.

We struggled to show success and ROSI for IT engagements, only obtaining 1-2 serious architectural and/or approach flaws using Threat Modeling. The environment is much more stable and there are more knowns, so TM seemed too trivial for some of our IT dev teams.

For our Product development and Software as a Service offerings (SaaS or Cloud Computing), Threat Modeling is at the core of what we do to ensure sound architecture and fundamentals to each of these areas.

Glad to see the tool is updated as well. We have been plodding along using Word/Visio templates for our Threat Models and hoping the tool works better for us this go around.

Thanks,

Phil Agcaoili