As software professionals, we often find ourselves entrenched in cybersecurity's serious and complex world, dissecting threats and weaknesses in systems integral to our daily lives. However, sometimes, a lighter approach can offer fresh perspectives and insights. In the spirit of the holiday season, let's embark on

Threat modelling is an integral component of the security architecture process, and its importance cannot be overstated in today's digital landscape. At its core, threat modelling is a proactive approach to identifying, prioritising, and managing the potential threats to a system. It systematically analyses what can go wrong

As software professionals, we often find ourselves entrenched in code, architecture, and cybersecurity. However, sometimes, drawing parallels from history can provide fresh insights into our work. Let's embark on a unique journey back to 1621, to the First Thanksgiving, and apply a modern threat model to this historical

In today's threat landscape, organisations must continuously monitor for new security threats to their products and proactively manage risk. One way to do this is by using threat modelling to proactively discover weaknesses in a product design. Sites like Twitter (X), used by over 300 million people monthly,

In today's threat landscape, organisations must proactively manage the risk of system and data exposure due to malicious activities on their software. Sites like Twitter, used by 300 million people every month, need robust security processes and tools for their build chains. That's because new vulnerabilities

Overview 3 Core security principles drive software architecture. These Core principles break into five architectural principles. The five architectural principles map to STRIDE. Each component should be developed with the concept of Defense-In-Depth. To do this in a consistent and repeatable manner, the following secure architectural definitions are made Core

OWASP Cheat sheets broken down by STRIDE category * Explains STRIDE at the top level and provides links to each of the elements https://en.wikipedia.org/wiki/STRIDE_(security [https://en.wikipedia.org/wiki/STRIDE_(security)]) * Spoofing https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html https://cheatsheetseries.owasp.org/

Threat modelling was originally an ad-hoc process to identify threats during the Waterfall requirements phase. As a result, it was usually a one-time exercise carried out in the early stages of a development lifecycle. In addition, it required highly specialised subject-matter experts who knew software architecture and application security. As

Nullcon is the largest annual security conference that has been happening since 2010 in Goa, India. The conference's focus is to showcase the next generation of offensive and defensive security technology. It's a space for infosec enthusiasts, researchers, hackers, and more, that gather from different countries