In today's threat landscape, organisations must continuously monitor for new security threats to their products and proactively manage risk. One way to do this is by using threat modelling to proactively discover weaknesses in a product design. Sites like Twitter (X), used by over 300 million people monthly,

In today's threat landscape, organisations must proactively manage the risk of system and data exposure due to malicious activities on their software. Sites like Twitter, used by 300 million people every month, need robust security processes and tools for their build chains. That's because new vulnerabilities

Overview 3 Core security principles drive software architecture. These Core principles break into five architectural principles. The five architectural principles map to STRIDE. Each component should be developed with the concept of Defense-In-Depth. To do this in a consistent and repeatable manner, the following secure architectural definitions are made Core

OWASP Cheat sheets broken down by STRIDE category * Explains STRIDE at the top level and provides links to each of the elements https://en.wikipedia.org/wiki/STRIDE_(security [https://en.wikipedia.org/wiki/STRIDE_(security)]) * Spoofing https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html https://cheatsheetseries.owasp.org/

Threat modelling was originally an ad-hoc process to identify threats during the Waterfall requirements phase. As a result, it was usually a one-time exercise carried out in the early stages of a development lifecycle. In addition, it required highly specialised subject-matter experts who knew software architecture and application security. As

Nullcon is the largest annual security conference that has been happening since 2010 in Goa, India. The conference's focus is to showcase the next generation of offensive and defensive security technology. It's a space for infosec enthusiasts, researchers, hackers, and more, that gather from different countries

Industry professionals are painfully aware that the design stage is an integral part of a successful security build. Experience shows that it is not always possible to reengineer design and thus reconfigure the applicable data and systems to remain secure by proxy. It seems a no-brainer that resilience to future

“The Battle for New York: A Case Study of Applied Digital Threat Modeling at the Enterprise Level,” revealed that threat modelling (in this case, the CoG framework) was adept at developing actionable defence plans for the NYC3 enterprise. Their evidence suggests that even a relatively limited amount of focused threat

The huge hike in internet-connected devices has formed a sizeable breeding ground for hackers and cybercriminals. In tandem, applications for the Internet of Things (IoT) are growing. As a result, the comparative challenges associated with IoT data security and privacy will increase during the short-term future. The motives for these

Most security programmes base their findings on protecting core IT components, including networks, storage, PCs and servers, and data centres. So honing in on infrastructure is key, but it’s not the only part of a well-established information security programme. Application security includes plenty of techniques that allow the process

Photo by Markus Spiske [https://unsplash.com/photos/QozzJpFZ2lg?utm_source=unsplash&utm_medium=referral&utm_content=creditCopyText] on Unsplash [https://unsplash.com/search/photos/leadership?utm_source=unsplash&utm_medium=referral&utm_content=creditCopyText] When you are a leader, you have loyal followers. If you

Photo by Franck V. [https://unsplash.com/photos/U3sOwViXhkY?utm_source=unsplash&utm_medium=referral&utm_content=creditCopyText] on Unsplash [https://unsplash.com/search/photos/automation?utm_source=unsplash&utm_medium=referral&utm_content=creditCopyText] People are phenomenal problem solvers, initially solving an issue and leveraging

Photo by Stephan Henning [https://unsplash.com/photos/S0hFspmvm_s?utm_source=unsplash&utm_medium=referral&utm_content=creditCopyText] on Unsplash [https://unsplash.com/search/photos/trends?utm_source=unsplash&utm_medium=referral&utm_content=creditCopyText] Here are some dynamic technologies and solutions to watch out

A threat actor is an entity that negatively impacts a TARGET and causes an event or incident. Therefore, it is helpful to know the capabilities and impact of various example Threat Actors. This post will outline the significant attributes and how they can describe potential malicious agents. The following Threat

The security champion should focus on the emergent design of the epic or feature that the team is building. This list breaks down the topics of emergent design and the security champion's integration tasks for the team's sprint workflow: 1. Help to install and maintain the