Скачать или смотреть Threat Modelling - Stop Hackers First [SINCON 2025]

Threat Modeling: Outthink Hackers Before They Strike

⚔️ "Know thy enemy." — Sun Tzu
Modern cybersecurity translation: To defend well, you must think like an attacker.

At #SINCON2025, cybersecurity expert Donavan breaks down threat modelling—for enterprises and individuals:

🔻 Your Phone’s Hidden Weak Spots
→ Swipe patterns: Smudges can reveal unlock codes
→ USB-C ports: Infected devices can hijack your phone
→ NFC payments: Skimmers steal wirelessly in crowds

🤖 AI Supercharges Social Engineering
From clumsy “Nigerian Prince” scams to hyper-targeted AI attacks that prey on:
→ Fear → Greed → Urgency

🧠 Think Like a Hacker: Creative Threat Modelling
The best defenses come from asking bold “what if” questions:
• “Could someone unlock my phone while I sleep?” → Facial recognition flaws
• “Can my child bypass parental controls?” → Shoulder-surfing threats

🛡️ Golden Rule:
Design safeguards around worst-case outcomes.
→ Don’t store everything in one digital basket.

Threat modelling – because strong security starts with asking 'what ifs' before attackers do
-----
00:38 – What is Threat Modelling ?
00:57 - Threat modelling: like protecting home valuables identify risks (eg. burglars), plan defenses (eg. safes); Anticipating & mitigating threats systematically
01:52 – Threat hunting: detect existing threats within a system; reactive — like searching for a burglar already inside your home
02:45 - Why do Threat Modelling?
02:50 – Threat modelling - think like an attacker to prioritise realistic threats
03:37 - Threat Modelling = Risk Management?
Threat Modelling:
03:46 –part of risk management that identifies & prioritizes cyber risks
04:20 –Helps direct resources toward the risks that matter most
04:44 - How to “think like a hacker”, master creative threat modelling
05:01 - Creative thinking: brainstorming to uncover non-obvious risks
06:14 - Most surprising threat found?
06:25 - tech focus could overlook humans who are often vulnerable to attacks
07:30 - Attackers novel techniques to exploit emotions?
07:54 - from crude scams to AI, still exploits basic human emotions (e.g. greed, fear)
08:39 – Phishing: Deliberate typos: filter out savvy users target the vulnerable with false promises
09:28 – Scenario for individuals with mobile phone?
09:40 – Mobile security: e.g. swipe patterns – maybe exposed by visible screen traces
10:16 - Facial recognition – can be tricked with photos or sleep exploits
11:03 - USB-C ports – vulnerable to infected USBs that run harmful code
11:19 - NFC payment systems - vulnerable to wireless skimming in crowded areas
12:00 – Personal approach?
12:43 - depends on individual risk
13:51 - Potential home threats include child shoulder-surfing
14:17 - No 100% security
14:40 - Consider the worst-case outcome
15:00 - To limit scam impact, "don’t put all your eggs in one basket"
15:40 - Consider worst case outcomes to guide safeguards
16:24 - What's the worst that can happen? - key to design safeguards that uphold trust & accountability
-----
Donavan Cheah (Senior Cybersecurity Consultant, Thales) has had more than eight years of experience in cybersecurity after successfully pivoting from an undergraduate degree in Physics.
He currently consults for a wide range of customers for advisory services such as governance, risk and compliance, threat modelling as well as penetration testing services. He has also built up a threat modelling practice in his previous role, and has built a cybersecurity gamification experience where players can understand cybersecurity through role-play.
He has given talks in regional conferences such as SECCON JP 13. He has also been on the advisory board of a conference in India, VulnCon, since 2024. He also writes numerous thought leadership blog articles and journal articles on ISACA on topics such as post-quantum cryptography and the intersection between the social sciences and cybersecurity.
He also volunteers with Division Zero (Div0) and ISACA. He contributes to the next generation through training as well, such as through his threat modelling workshops at the Global Cybersecurity Camp 2025 in Taiwan, Seasides Goa as well as OT Security workshops with Div0. He also has an active mentorship practice, mentoring younger generations of cybersecurity professionals from all around the world.
-----
Recorded on 23rd May 2025, at SINCON 2025, Singapore
-----
Stay with us:
LinkedIn ➡️   / lojane  
YouTube ➡️ https://cutt.ly/U2B0yVi

#misscyberpenny
#cybersecurity
#cybercrime