Скачать или смотреть 3. Threat Modelling in a Minute: Why Gamify it?

Grant Ongers, Global Board of Directors at OWASP Foundation | CTO at Secure Delivery, presents the third video in the series ‘Threat Modelling in a Minute’ from https://securedelivery.io/; ‘Why Gamify it?’

Try copi for yourself here: https://copi.securedelivery.io/

See more from us:
  / securedelivery  
  / 64760689  
  / securedelivery.io  


Video transcript
Why Gamify it?
• We have a built in need to compete.
o That competitive instinct makes us try harder and to put more into things;
o Developers, especially are competitive and they have the best knowledge about the things they built
• Threat Modelling is not fun
o Usually they involve security folk tearing apart things others have built;
o That’s not pleasant for the developers; and
o (unless your security team are complete psychopaths) it’s not fun for them either
 they generally think of it in terms of building the threat model;
 not destroying your baby
• Games are fun!
o Especially when there are prizes!

We use two games to do threat modelling:
• Cornucopia (what Copi was build to do online); and
• Elevation of Privilege

Why Elevation of Privilege?
• EoP is threat modelling from a Security Point of View
o Using STRIDE
 Spoofing
 Tampering
 Repudiation
 Information Disclosure
 Denial of service
 Elevation of Privilege

Why Cornucopia?
• Developer view-point
• Builds on the shoulders of giants