Adam Shostack
The Threat Modelling Canon
Threat Modeling: Designing for Security, and STRIDE in practice
Rating
85Impact score
Domains
Threat modellingPrivacySecurity design
Scouting report
Drove threat modelling into shippable practice at Microsoft, including the Elevation of Privilege card game that got non-security engineers doing it voluntarily, then wrote Threat Modeling: Designing for Security and later Threats: What Every Engineer Should Learn. Served on the CVE editorial board and co-wrote The New School of Information Security on learning from breach data.
Curator’s note
Four questions — what are we building, what can go wrong, what do we do, did we do a good job.
Portrait
Painted from a photograph of Adam Shostack by Adam Shostack, supplied by the subject.
Sources
- 01Adam Shostack’s site shostack.org
- 02Elevation of Privilege threat modelling game shostack.org