Shakedown Social

Paco Hope #resistI just saw <a href="https://docs.diniscruz.ai/2025/05/29/advancing-threat-modeling-with-semantic-knowledge-graphs.html" rel="nofollow noopener noreferrer" target="_blank">this paper by Dinis Cruz</a> on <a href="https://infosec.exchange/tags/ThreatModeling" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ThreatModeling</a> with <a href="https://infosec.exchange/tags/LLMs" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#LLMs</a>. I've been thinking along these lines for a while, but he's written it down completely and cogently. I agree with a lot of what I have read so far (Haven't finished it yet)Edit: <a href="https://fediscience.org/@WiseWoman" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@WiseWoman</a> called my attention to the fact that Dinis lists "ChatGPT Deep Research" as a co-author(?). Sigh. No wonder this text passed the sniff test. It's so full of chatbot output he gave the chatbot co-author credit.Ah well. Some of it is right. But now the inconsistencies make sense.<a href="https://infosec.exchange/tags/appsec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#appsec</a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infosec</a> <a href="https://infosec.exchange/tags/security" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#security</a>

Adam Shostack :donor: :rebelverified:Nice list of things to listen for from <a href="https://infosec.exchange/@kaoudis" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@kaoudis</a> <a href="https://infosec.exchange/tags/threatmodeling" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#threatmodeling</a> but more broad. <a href="https://infosec.exchange/tags/tmcon" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#tmcon</a>

OWASP Foundation🔐 Get Ready for OWASP Global AppSec USA 2025! 🔐This event is built for everyone in the CyberSec community, whether you want to expand your skills or discover new solutions, this is the event for you.🎟️ Register now: <a href="https://owasp.glueup.com/event/131624/register/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://owasp.glueup.com/event/131624/register/</a><a href="https://infosec.exchange/tags/OWASP" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OWASP</a> <a href="https://infosec.exchange/tags/AppSecUSA2025" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#AppSecUSA2025</a> <a href="https://infosec.exchange/tags/Cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Cybersecurity</a> <a href="https://infosec.exchange/tags/ApplicationSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ApplicationSecurity</a> <a href="https://infosec.exchange/tags/DevSecOps" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DevSecOps</a> <a href="https://infosec.exchange/tags/InfoSec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#InfoSec</a> <a href="https://infosec.exchange/tags/Hacking" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Hacking</a> <a href="https://infosec.exchange/tags/ThreatModeling" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ThreatModeling</a> <a href="https://infosec.exchange/tags/AI" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#AI</a> <a href="https://infosec.exchange/tags/WashingtonDCEvents" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#WashingtonDCEvents</a> <a href="https://infosec.exchange/tags/SecureByDesign" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#SecureByDesign</a>

BSides Boulder⚡ Attackers are more regularly targeting industrial control systems (ICS) on Operational Technology (OT), which have led to devistating real world consequences 😵 Trace attack paths in ICS with Gilberto "Gil" Garcia's <a href="https://infosec.exchange/tags/BSidesBoulder25" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#BSidesBoulder25</a> talk "Attack Path Modeling for Securing ICS/OT Systems"! Attendees will learn how to visualize adversary movements, focus on crown jewels, and turn free tools and threat intel into actionable defense strategies through understanding attacker workflows. Garcia's session will also delve into frameworks, modeling techniques, and the integration of intelligence-driven security measures to strengthen ICS/OT resilience - because in critical infrastructure, guesswork isn’t a good option! 🛠️🔌 <a href="https://infosec.exchange/tags/BSides" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#BSides</a> <a href="https://infosec.exchange/tags/BSidesBoulder" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#BSidesBoulder</a> <a href="https://infosec.exchange/tags/ICS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ICS</a> <a href="https://infosec.exchange/tags/CyberSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CyberSecurity</a> <a href="https://infosec.exchange/tags/OTSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OTSecurity</a> <a href="https://infosec.exchange/tags/ThreatModeling" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ThreatModeling</a>Tickets are available for purchase for our 13 June event here: <a href="https://www.eventbrite.com/e/bsides-boulder-2025-registration-1290129274389" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.eventbrite.com/e/bsides-boulder-2025-registration-1290129274389</a>

Paco Hope #resistI have seen a lot of efforts to use an <a href="https://infosec.exchange/tags/LLM" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#LLM</a> to create a <a href="https://infosec.exchange/tags/ThreatModel" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ThreatModel</a>. I have some insights. Attempts at <a href="https://infosec.exchange/tags/AI" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#AI</a> <a href="https://infosec.exchange/tags/ThreatModeling" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ThreatModeling</a> tend to do 3 things wrong:<ol><li>They assume that the user's input is both complete and correct. The LLM (in the implementations I've seen) never questions "are you sure?" and it never prompts the user like "you haven't told me X, what about X?"</li><li>Lots of teams treat a threat model as a deliverable. Like we go build our code, get ready to ship, and then "oh, shit! Security wants a threat model. Quick, go make one." So it's not this thing that informs any development choices during development. It's an afterthought that gets built just prior to <a href="https://infosec.exchange/tags/AppSec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#AppSec</a> review.</li><li>Lots of people think you can do an adequate threat model with only technical artifacts (code, architectuer, data flow, documentation, etc.). There's business context that needs to be part of every decision, and teams are just ignoring that.</li></ol>1/n

Adam Shostack :donor: :rebelverified:My <a href="https://infosec.exchange/tags/Appsec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Appsec</a> roundup for April is live. No blow by blow masto post this time because i have to head to the airport soon for <a href="https://infosec.exchange/tags/rsac" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#rsac</a> Lots of <a href="https://infosec.exchange/tags/threatmodeling" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#threatmodeling</a>, important improvements to <a href="https://infosec.exchange/tags/llm" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#llm</a> <a href="https://infosec.exchange/tags/security" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#security</a> and more<a href="https://shostack.org/blog/appsec-roundup-april/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://shostack.org/blog/appsec-roundup-april/</a>

GeneralX ⏯️"The Signals Network (TSN) and the Reynolds Journalism Institute (RJI) are launching comprehensive training for journalists working with sensitive sources.The training modules will live permanently on TSN’s website and be free to access."<a href="https://rjionline.org/news/protecting-the-protectors/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://rjionline.org/news/protecting-the-protectors/</a> <a href="https://freeradical.zone/tags/journalism" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#journalism</a> <a href="https://freeradical.zone/tags/whistleblowers" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#whistleblowers</a> <a href="https://freeradical.zone/tags/digitalsecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#digitalsecurity</a> <a href="https://freeradical.zone/tags/privacy" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#privacy</a> <a href="https://freeradical.zone/tags/threatmodeling" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#threatmodeling</a>

Gary McGrawMaking automated Threat Modeling better with applied ML. A recorded webinar that I participate in yesterday. <a href="https://sigmoid.social/tags/MLsec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#MLsec</a> <a href="https://sigmoid.social/tags/ML" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ML</a> <a href="https://sigmoid.social/tags/security" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#security</a> <a href="https://sigmoid.social/tags/swsec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#swsec</a> <a href="https://sigmoid.social/tags/appsec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#appsec</a> <a href="https://sigmoid.social/tags/threatmodeling" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#threatmodeling</a> <a href="https://www.youtube.com/playlist?list=PLpo8W6wt_WV-haEOL-nWyz5TKhJOJ5Gao" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.youtube.com/playlist?list=PLpo8W6wt_WV-haEOL-nWyz5TKhJOJ5Gao</a>

9x0rgHi <a href="https://mastodon.social/@elizayer" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@elizayer</a>,Here's a good write-up about <a href="https://mamot.fr/tags/ThreatModeling" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ThreatModeling</a> by <a href="https://mastodon.neat.computer/@privacyguides" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@privacyguides</a>: <a href="https://www.privacyguides.org/en/basics/threat-modeling/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.privacyguides.org/en/basics/threat-modeling/</a>Also, these are the VPN they recommended - and why:**VPN Services** <a href="https://www.privacyguides.org/en/vpn/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.privacyguides.org/en/vpn/</a>[Spoiler: NordVPN is **not** on the list, for good reasons]Hope this helps. <a href="https://mastodon.publicinterest.town/@krusynth" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@krusynth</a>

Kelly Shortridgeso many <a href="https://hachyderm.io/tags/threat" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#threat</a> modeling workflows are uncivilized, creaky, positively antediluvian. <a href="https://hachyderm.io/tags/threatmodeling" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#threatmodeling</a> should be modern, configured as code, a creative, collaborative romp to reify a defensive strategy that outmaneuvers attackers.thus, this yule, my deciduous.app co-conspirator <a href="https://hachyderm.io/@rpetrich" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@rpetrich</a> and I bear a gift: Deciduous-VS, a <a href="https://hachyderm.io/tags/VSCode" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#VSCode</a> extension to build and visualize decision trees within your IDE 🎄 (== local dev for classified/regulated envs, too)learn more in my post: <a href="https://kellyshortridge.com/blog/posts/deciduous-for-vscode-local-decision-tree-editing/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://kellyshortridge.com/blog/posts/deciduous-for-vscode-local-decision-tree-editing/</a>

tuxwise(19/N) Let's now turn to the third question of the <a href="https://mastodon.de/tags/ThreatModelingManifesto" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ThreatModelingManifesto</a>: 3. What are you going to do about it?It pays to first establish a few contraints for what you can do, in theory, by <a href="https://mastodon.de/tags/classifying" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#classifying</a> your <a href="https://mastodon.de/tags/assets" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#assets</a>. Again, for an individual human being, opposed to organizations or companies, it's nearly impossible to impose principles like <a href="https://mastodon.de/tags/ZeroTrust" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ZeroTrust</a> or <a href="https://mastodon.de/tags/NeedToKnow" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#NeedToKnow</a> on personal relationships, the closer they get.So, avoid recycling terms from popular, but less intuitive schemes: Fanciful intelligence labels like “top secret”, “confidential”, or “unclassified” do not tell you what goes into the respective box, and how to handle access to it.Add another column to your assets spreadsheet, label it "Classification", and pick a more human-centered approach for its values, like:<ul><li>For Your Eyes Only (FYEO)</li><li>Intimate</li><li>None Of Your Business (NOYB)</li><li>Shared</li><li>Public</li></ul>Let's briefly go through these suggestions:For Your Eyes Only (FYEO)Assets that are only accessible to, and controlled by nobody but you, because they need to be resilient, even in the face of the closest of your close people misbehaving. Preferably, these assets are kept publicly undetectable and unknown. When you are gone, these assets will be gone, too. FYEO does not make a good default class, though.Start of this thread: <a href="https://mastodon.de/@tuxwise/113503228291818865" translate="no" rel="nofollow noopener noreferrer" target="_blank">https://mastodon.de/@tuxwise/113503228291818865</a><a href="https://mastodon.de/tags/ThreatModeling" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ThreatModeling</a> <a href="https://mastodon.de/tags/4D" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#4D</a>

tuxwise(18/N) Revisit your spreadsheet of assets now, specifically the "Consequences" column we had added in (7/N).<ul><li>Expanding the simplified approach to threats from "disclosed, destroyed, deanonymized" to the full set of threat types; and</li><li>Taking into account all categories of adversaries:</li></ul>How does your assessment of potential consequences change? Walk through your list of assets, and change the values in the "Consequences" column where needed.Categories of adversaries:<ul><li>You, and people like you</li><li>Criminals</li><li>Ideologues</li><li>Intruders</li><li>Business(i)es</li><li>“They”</li></ul>Threat types:<ul><li>Linking</li><li>Identifiying</li><li>Undesirable non-repudiation or repudiation</li><li>Detecting</li><li>Data disclosure</li><li>Manufacturing cooperation</li><li>Non-compliance</li><li>Obstructing</li><li>Interfering</li></ul>Consequences… when threats by adversaries become reality (feel free to change and rename):<ul><li>🤷 So what?</li><li>😟 Oh…</li><li>😳 Ouch.</li><li>😭 Hurts badly.</li><li>😱 Life-changing disaster.</li></ul>Consequences (7/N): <a href="https://mastodon.de/@tuxwise/113548439494399874" translate="no" rel="nofollow noopener noreferrer" target="_blank">https://mastodon.de/@tuxwise/113548439494399874</a>Categories of adversaries (8/N): <a href="https://mastodon.de/@tuxwise/113560309025649046" translate="no" rel="nofollow noopener noreferrer" target="_blank">https://mastodon.de/@tuxwise/113560309025649046</a>Types of threats (14/N): <a href="https://mastodon.de/@tuxwise/113622961370958693" translate="no" rel="nofollow noopener noreferrer" target="_blank">https://mastodon.de/@tuxwise/113622961370958693</a>Start of this thread: <a href="https://mastodon.de/@tuxwise/113503228291818865" translate="no" rel="nofollow noopener noreferrer" target="_blank">https://mastodon.de/@tuxwise/113503228291818865</a><a href="https://mastodon.de/tags/ThreatModeling" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ThreatModeling</a> <a href="https://mastodon.de/tags/4D" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#4D</a>

tuxwise(17/N) Finally, two threat types that refer to security more than privacy:<a href="https://mastodon.de/tags/Obstructing" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Obstructing</a>An adversary destroys, withdraws, steals or misappropriates information, access, or resources. The obstruction can be temporary or permanent, partial or total. Obstructing can also occur unintentionally, with the “adversary” being deterioration, malfunction, or disaster.<a href="https://mastodon.de/tags/Interfering" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Interfering</a>An adversary deliberately corrupts the integrity or authenticity of information, resources, processes, or interactions. The respective information, resources, processes, or interactions aren’t necessarily controlled or owned by the persons that are affected, and may also be fabricated. Interfering can also occur unintentionally, with the “adversary” being deterioration, malfunction, or disaster.Start of this thread: <a href="https://mastodon.de/@tuxwise/113503228291818865" translate="no" rel="nofollow noopener noreferrer" target="_blank">https://mastodon.de/@tuxwise/113503228291818865</a><a href="https://mastodon.de/tags/ThreatModeling" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ThreatModeling</a> <a href="https://mastodon.de/tags/4D" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#4D</a>

tuxwise(16/N) Three more threat types defined:Data <a href="https://mastodon.de/tags/disclosure" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#disclosure</a>An adversary makes somebody’s confidential data available to unauthorized parties.Manufacturing cooperationAn adversary hides from somebody the potentially harmful consequences of their own decisions and actions, or denies them the option of avoiding such consequences, even when they are aware of them.<a href="https://mastodon.de/tags/NonCompliance" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#NonCompliance</a>Contrary to what somebody expects and trusts in, an adversary does not follow laws, documented policies or contractual obligations; or does not abide by what is perceived as conventions, or unwritten rules, in the respective context.(to be continued)Start of this thread: <a href="https://mastodon.de/@tuxwise/113503228291818865" translate="no" rel="nofollow noopener noreferrer" target="_blank">https://mastodon.de/@tuxwise/113503228291818865</a><a href="https://mastodon.de/tags/ThreatModeling" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ThreatModeling</a> <a href="https://mastodon.de/tags/4D" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#4D</a>

tuxwise(15/N) Two more threat types defined:Undesirable non-repudiation or repudiation<a href="https://mastodon.de/tags/Repudiation" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Repudiation</a> (plausible denial) of what somebody has said / done / known / possessed becomes impossible because an adversary has managed to collect enough evidence to establish undesirable non-repudiation. In other words: the adversary can prove beyond reasonable doubt that "it" happened.Alternatively, <a href="https://mastodon.de/tags/NonRepudiation" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#NonRepudiation</a> (proof beyond reasonable doubt) cannot be established because an adversary has managed to suppress or destroy enough evidence to gain the option of repudiation (plausible denial). In other words: the adversary can plausibly deny "it" happened.DetectingAn adversary can check for the presence or absence of specific data items, which are tell-tale indicators for something else.(to be continued)Start of this thread: <a href="https://mastodon.de/@tuxwise/113503228291818865" translate="no" rel="nofollow noopener noreferrer" target="_blank">https://mastodon.de/@tuxwise/113503228291818865</a><a href="https://mastodon.de/tags/ThreatModeling" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ThreatModeling</a> <a href="https://mastodon.de/tags/4D" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#4D</a>

tuxwise(14/N) Having familiarized ourselves with categories of adversaries, their main goals and their respective, overall "modus operandi", let's look at the types of threats posed by them.Again, it pays to focus on types of threats: We don't want to become mainly alert-triggered, but proactive. There are several frameworks we can borrow ideas from, most notably the LINDDUN framework that is geared toward threats to privacy, and can be extended a bit to cover more ground.First, our list of threat types:<ul><li><a href="https://mastodon.de/tags/Linking" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Linking</a> (spotting connections and relationships)</li><li><a href="https://mastodon.de/tags/Identifying" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Identifying</a> (mapping to identities)</li><li>Undesirable <a href="https://mastodon.de/tags/NonRepudiation" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#NonRepudiation</a> or <a href="https://mastodon.de/tags/repudiation" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#repudiation</a></li><li><a href="https://mastodon.de/tags/Detecting" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Detecting</a> (absence or presence of indicators)</li><li>Data <a href="https://mastodon.de/tags/disclosure" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#disclosure</a> (to the unauthorized)</li><li>Manufacturing cooperation (disguised or imposed bad consequences)</li><li><a href="https://mastodon.de/tags/Obstructing" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Obstructing</a> (access, information, resources)</li><li><a href="https://mastodon.de/tags/NonCompliance" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#NonCompliance</a></li><li><a href="https://mastodon.de/tags/Interfering" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Interfering</a> (with information, resources, processes, interactions)</li></ul>Our definitions of these, for our context:LinkingAn adversary can figure out connections and relationships between formerly isolated items of interest.IdentifiyingAn adversary can link items of interest directly to a natural person.(to be continued)Start of this thread: <a href="https://mastodon.de/@tuxwise/113503228291818865" translate="no" rel="nofollow noopener noreferrer" target="_blank">https://mastodon.de/@tuxwise/113503228291818865</a>LINDDUN: <a href="https://linddun.org/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://linddun.org/</a><a href="https://mastodon.de/tags/ThreatModeling" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ThreatModeling</a> <a href="https://mastodon.de/tags/4D" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#4D</a>

tuxwise(13/N) The sixth, and last, category of adversaries:“They”“They” want to define boundaries and acceptable behavior for the masses, as well as monitor compliance on a large scale, and enforce it on an individual level.As a consequence, permanent mass <a href="https://mastodon.de/tags/surveillance" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#surveillance</a> of all types of assets is a means of monitoring the compliance of the majority, and of detecting deviant behavior. Legalizing more and more monitoring options becomes a goal, including international partnerships on information exchange. Depriving you of your assets, temporarily or permanently, is a means of enforcing your compliance or obedience. The mere threat of this can be sufficient to create a <a href="https://mastodon.de/tags/ChillingEffect" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ChillingEffect</a>.State-sponsored actors (such as hacker groups) and nation-state threat actors (in the form of intelligence services, law enforcement, censorship offices, and other <a href="https://mastodon.de/tags/government" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#government</a> agencies) fall into this category. It also includes <a href="https://mastodon.de/tags/companies" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#companies</a> that have either a monopoly, or a significant share of an oligopolistic market, or portfolio of services specifically targeted at the public sector.While the entities in this category may seem wildly heterogeneous at first, remember that there are <a href="https://mastodon.de/tags/RevolvingDoors" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#RevolvingDoors</a> between them, for swapping their respective “ex” members. Beyond lobbying, there is also a complex, ongoing collaboration between many of them, which has been described as “grey intelligence”, “grey policing”, “public-private partnership”, etc.Start of this thread: <a href="https://mastodon.de/@tuxwise/113503228291818865" translate="no" rel="nofollow noopener noreferrer" target="_blank">https://mastodon.de/@tuxwise/113503228291818865</a><a href="https://mastodon.de/tags/ThreatModeling" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ThreatModeling</a> <a href="https://mastodon.de/tags/4D" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#4D</a>

Jonathan Kamens 86 47On a list I'm on, someone asks for advice protecting a small trans support org worried about e.g. keeping their membership list safe. Several people respond, "Talk to company <x>, they help non-profits secure infra." I look at <x>. Its flagship product automates managing security controls in apps like Google Workspace and Slack. I'm like, this isn't going to help when the subpoenas start flying. Y'all need to change your threat model. <a href="https://federate.social/tags/smdh" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#smdh</a> <a href="https://federate.social/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infosec</a> <a href="https://federate.social/tags/threatModeling" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#threatModeling</a> <a href="https://federate.social/tags/politics" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#politics</a> <a href="https://federate.social/tags/USPol" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#USPol</a>

tuxwise(2/N) The "<a href="https://mastodon.de/tags/ThreatModelingManifesto" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ThreatModelingManifesto</a>" is a great framework for businesses and organizations. Applying it to a more private context becomes easier for me when I make its key questions more personal:<ol><li>What are you working on?</li><li>What can go wrong?</li><li>What are you going to do about it?</li><li>Did you do a good enough job?</li></ol>Next two posts will cover my answers to 1).<a href="https://www.threatmodelingmanifesto.org/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.threatmodelingmanifesto.org/</a>Note: Essentially, the <a href="https://mastodon.de/tags/4D" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#4D</a>s are my answers to 3).<a href="https://mastodon.de/@tuxwise/113503228291818865" translate="no" rel="nofollow noopener noreferrer" target="_blank">https://mastodon.de/@tuxwise/113503228291818865</a><a href="https://mastodon.de/tags/ThreatModeling" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ThreatModeling</a> <a href="https://mastodon.de/tags/4D" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#4D</a>

shellsharksWhat methodology is your "go to” when conducting a <a href="https://shellsharks.social/tags/threatmodeling" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#threatmodeling</a> exercise? For infosec folks, do you or your team use a specific methodology for threat modeling systems at your respective org?

Recent searches

Search options

Administered by:

Server stats:

#threatmodeling